CVE-2026-89651

A flaw was found in the Linux kernel's Ceph client. An out-of-bounds read vulnerability exists in the handlesession function when decoding MDSCapAuth records. A malicious or compromised Metadata Server MDS can trigger this during session setup without client-side user interaction. This can force...

CVE-2026-89650

A flaw was found in the Linux kernel's Ceph client. A malicious or compromised Ceph monitor, or an on-path attacker, can send a specially crafted Metadata Server MDS map. This map, with an oversized numexporttargets field and a per-MDS info version of 2 or 3, can trigger an out-of-bounds read in...

CVE-2026-89648

A flaw was found in the Linux kernel's Ceph client. A malicious or compromised Ceph Metadata Server MDS could send a specially crafted reply with an unbounded number of delegated inode intervals. This could cause the client to enter an infinite loop or exhaust memory resources, leading to a denia...

CVE-2026-89657

In the Linux kernel, the following vulnerability has been resolved: libceph: validate OSD extent maps before cursor advance net/ceph/osdclient.c:osdsparseread validates that the sparse-read data length matches the summed extent lengths, but it does not validate that each OSD-supplied extent is...

CVE-2026-89650

In the Linux kernel, the following vulnerability has been resolved: ceph: bound numexporttargets array for mds info v2/v3 cephmdsmapdecode in fs/ceph/mdsmap.c reads numexporttargets from each per-mds info record and advances the decode cursor by numexporttargets sizeofu32 without first checking...

CVE-2026-89651

In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fsname decode in handlesession handlesession decodes the MDSCapAuth records carried by a CEPHSESSIONOPEN message msgversion = 6. For each record the match.path and match.fsname byte strings are rea...

DEBIAN-CVE-2026-89648

In the Linux kernel, the following vulnerability has been resolved: ceph: cap delegated inode count in cephparsedeleginos cephparsedeleginos decodes interval sets of delegated inode numbers from an MDS create-with-delegation reply. For each set it reads a 64-bit start and a 64-bit len with...

UBUNTU-CVE-2026-89648

In the Linux kernel, the following vulnerability has been resolved: ceph: cap delegated inode count in cephparsedeleginos cephparsedeleginos decodes interval sets of delegated inode numbers from an MDS create-with-delegation reply. For each set it reads a 64-bit start and a 64-bit len with...

EUVD-2026-76560

In the Linux kernel, the following vulnerability has been resolved: ceph: cap delegated inode count in cephparsedeleginos cephparsedeleginos decodes interval sets of delegated inode numbers from an MDS create-with-delegation reply. For each set it reads a 64-bit start and a 64-bit len with...

CVE-2026-89648 ceph: cap delegated inode count in ceph_parse_deleg_inos()

In the Linux kernel, the following vulnerability has been resolved: ceph: cap delegated inode count in cephparsedeleginos cephparsedeleginos decodes interval sets of delegated inode numbers from an MDS create-with-delegation reply. For each set it reads a 64-bit start and a 64-bit len with...

CVE-2026-89648

In the Linux kernel, the following vulnerability has been resolved: ceph: cap delegated inode count in cephparsedeleginos cephparsedeleginos decodes interval sets of delegated inode numbers from an MDS create-with-delegation reply. For each set it reads a 64-bit start and a 64-bit len with...

PT-2026-90364

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel's Ceph implementation where the ceph parse deleg inos function fails to validate the value of the len variable when decoding interval sets of delegate...

PT-2026-90367

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the handle session function when decoding MDSCapAuth records within a CEPH SESSION OPEN message. The function uses ceph decode copy to read the match.path...

CVE-2026-80527

A flaw was found in the Linux kernel's Ceph client. A reader can experience an indefinite hang when the client's local capability state mdswanted becomes stale after a Metadata Server MDS capability revocation. This occurs because the client believes it still wants a capability e.g., FILERD that...

CVE-2026-80557

In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decodewatchers via missing bounds check cephstartdecoding validates that structlen bytes remain in the buffer after the encoding header, but accepts structlen=0 as valid: cephdecodeneedp, end, 0, bad alwa...

SUSE CVE-2026-68160

In the Linux kernel, the following vulnerability has been resolved: ceph: fix pre-auth out-of-bounds read on snaptrace in cephhandlecaps cephhandlecaps reads snaptracelen from the wire-format cephmdscaps header and uses it unconditionally to build a fake end pointer snaptrace + snaptracelen that ...

SUSE CVE-2026-68155

In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPHMSGMONMAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the existing monitors in the cluster. Currently...

UBUNTU-CVE-2026-68155

In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPHMSGMONMAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the existing monitors in the cluster. Currently...

RHEL 9 : kernel (RHSA-2026:27708)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:27708 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: smc: Fix use-after-free in...

RXSA-2026:13565 Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state CVE-2026-23136 kernel: Linux kernel: Use-after-free in traffic control actct may lead to denial of...