EUVD-2026-76565

In the Linux kernel, the following vulnerability has been resolved: ceph: reject exporttargets ranks = CEPHMAXMDS in mdsmap decode MDSMap exporttargets entries are monitor controlled. checknewmap uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can...

CVE-2026-89653

A vulnerability in the Linux kernel's Ceph filesystem allows an out-of-bounds write during MDSMap decoding. The MDSMap export_targets entries are monitor-controlled , and the check_new_map() function uses each entry as a bit number in a fixed stack bitmap. A rank value ≥ CEPH_MAX_MDS causes set_b...

EUVD-2026-76564

In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS export getname cephgetname copies the MDS-supplied name into the caller's NAMEMAX-sized buffer with memcpyname, rinfo-dname, rinfo-dnamelen and then writes namerinfo-dnamelen = 0,...

CVE-2026-89652 ceph: bound copied dentry name length in NFS export get_name

In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS export getname cephgetname copies the MDS-supplied name into the caller's NAMEMAX-sized buffer with memcpyname, rinfo-dname, rinfo-dnamelen and then writes namerinfo-dnamelen = 0,...

CVE-2026-89652

In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS export getname cephgetname copies the MDS-supplied name into the caller's NAMEMAX-sized buffer with memcpyname, rinfo-dname, rinfo-dnamelen and then writes namerinfo-dnamelen = 0,...

CVE-2026-89652 ceph: bound copied dentry name length in NFS export get_name

In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS export getname cephgetname copies the MDS-supplied name into the caller's NAMEMAX-sized buffer with memcpyname, rinfo-dname, rinfo-dnamelen and then writes namerinfo-dnamelen = 0,...

EUVD-2026-76563

In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fsname decode in handlesession handlesession decodes the MDSCapAuth records carried by a CEPHSESSIONOPEN message msgversion = 6. For each record the match.path and match.fsname byte strings are rea...

CVE-2026-89651 ceph: bound MDSCapAuth path and fs_name decode in handle_session()

In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fsname decode in handlesession handlesession decodes the MDSCapAuth records carried by a CEPHSESSIONOPEN message msgversion = 6. For each record the match.path and match.fsname byte strings are rea...

CVE-2026-89651

In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fsname decode in handlesession handlesession decodes the MDSCapAuth records carried by a CEPHSESSIONOPEN message msgversion = 6. For each record the match.path and match.fsname byte strings are rea...

CVE-2026-89650 ceph: bound num_export_targets array for mds info v2/v3

In the Linux kernel, the following vulnerability has been resolved: ceph: bound numexporttargets array for mds info v2/v3 cephmdsmapdecode in fs/ceph/mdsmap.c reads numexporttargets from each per-mds info record and advances the decode cursor by numexporttargets sizeofu32 without first checking...

CVE-2026-89650

In the Linux kernel, the following vulnerability has been resolved: ceph: bound numexporttargets array for mds info v2/v3 cephmdsmapdecode in fs/ceph/mdsmap.c reads numexporttargets from each per-mds info record and advances the decode cursor by numexporttargets sizeofu32 without first checking...

CVE-2026-89649

This out-of-bounds read affects the Linux kernel's CephFS client , specifically the __build_xattrs() function. When decoding the xattr blob supplied by a Ceph metadata server (MDS), the 32-bit value length of the final attribute is never validated against the blob size via a ceph_decode_need() ch...

EUVD-2026-76561

In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in buildxattrs buildxattrs decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length,...

CVE-2026-89649 ceph: bound xattr value length in __build_xattrs()

In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in buildxattrs buildxattrs decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length,...

CVE-2026-89649 ceph: bound xattr value length in __build_xattrs()

In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in buildxattrs buildxattrs decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length,...

CVE-2026-89650

CVE-2026-89650 is a slab-out-of-bounds read in the Linux kernel's CephFS client , specifically in ceph_mdsmap_decode() (fs/ceph/mdsmap.c). When decoding an MDS map with per-MDS info version 2 or 3, the function advances the decode cursor by num_export_targets * sizeof(u32) without verifying remai...

CVE-2026-89649

In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in buildxattrs buildxattrs decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length,...

CVE-2026-89650 ceph: bound num_export_targets array for mds info v2/v3

In the Linux kernel, the following vulnerability has been resolved: ceph: bound numexporttargets array for mds info v2/v3 cephmdsmapdecode in fs/ceph/mdsmap.c reads numexporttargets from each per-mds info record and advances the decode cursor by numexporttargets sizeofu32 without first checking...

EUVD-2026-76562

In the Linux kernel, the following vulnerability has been resolved: ceph: bound numexporttargets array for mds info v2/v3 cephmdsmapdecode in fs/ceph/mdsmap.c reads numexporttargets from each per-mds info record and advances the decode cursor by numexporttargets sizeofu32 without first checking...

CVE-2026-89648 ceph: cap delegated inode count in ceph_parse_deleg_inos()

In the Linux kernel, the following vulnerability has been resolved: ceph: cap delegated inode count in cephparsedeleginos cephparsedeleginos decodes interval sets of delegated inode numbers from an MDS create-with-delegation reply. For each set it reads a 64-bit start and a 64-bit len with...