554 matches found
CVE-2026-89650
A flaw was found in the Linux kernel's Ceph client. A malicious or compromised Ceph monitor, or an on-path attacker, can send a specially crafted Metadata Server MDS map. This map, with an oversized numexporttargets field and a per-MDS info version of 2 or 3, can trigger an out-of-bounds read in...
CVE-2026-89650
In the Linux kernel, the following vulnerability has been resolved: ceph: bound numexporttargets array for mds info v2/v3 cephmdsmapdecode in fs/ceph/mdsmap.c reads numexporttargets from each per-mds info record and advances the decode cursor by numexporttargets sizeofu32 without first checking...
CVE-2026-89651
In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fsname decode in handlesession handlesession decodes the MDSCapAuth records carried by a CEPHSESSIONOPEN message msgversion = 6. For each record the match.path and match.fsname byte strings are rea...
CVE-2026-89648
In the Linux kernel, the following vulnerability has been resolved: ceph: cap delegated inode count in cephparsedeleginos cephparsedeleginos decodes interval sets of delegated inode numbers from an MDS create-with-delegation reply. For each set it reads a 64-bit start and a 64-bit len with...
CVE-2026-89654
CVE-2026-89654 is a Use-After-Free (UAF) in the Linux kernel's Ceph filesystem (ceph), specifically in check_new_map(). Three code paths—address changed, reconnect, and active transition—drop mdsc->mutex without acquiring an additional reference on the MDS session object. During the unlock win...
CVE-2026-89652
CVE-2026-89652 is a slab out-of-bounds write in the Linux kernel's Ceph filesystem NFS export path. The functions ceph_get_name() and __get_snap_name() copy MDS-supplied dentry names into a NAME_MAX-sized buffer via memcpy without validating the length against NAME_MAX. A malicious or compromised...
EUVD-2026-76563
In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fsname decode in handlesession handlesession decodes the MDSCapAuth records carried by a CEPHSESSIONOPEN message msgversion = 6. For each record the match.path and match.fsname byte strings are rea...
CVE-2026-89651 ceph: bound MDSCapAuth path and fs_name decode in handle_session()
In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fsname decode in handlesession handlesession decodes the MDSCapAuth records carried by a CEPHSESSIONOPEN message msgversion = 6. For each record the match.path and match.fsname byte strings are rea...
CVE-2026-89651
CVE-2026-89651 affects the Linux kernel Ceph MDS client . In handle_session(), the match.path and match.fs_name byte strings within MDSCapAuth records are decoded using a bare ceph_decode_copy() without the required ceph_decode_need() bounds check. A malicious or compromised MDS can craft a CEPH_...
CVE-2026-89650 ceph: bound num_export_targets array for mds info v2/v3
In the Linux kernel, the following vulnerability has been resolved: ceph: bound numexporttargets array for mds info v2/v3 cephmdsmapdecode in fs/ceph/mdsmap.c reads numexporttargets from each per-mds info record and advances the decode cursor by numexporttargets sizeofu32 without first checking...
CVE-2026-89650
CVE-2026-89650 affects the Linux kernel's CephFS client in fs/ceph/mdsmap.c. The function ceph_mdsmap_decode() reads num_export_targets from per-MDS info records and advances the decode cursor by num_export_targets * sizeof(u32) without verifying that enough bytes remain. The upper-bound check is...
EUVD-2026-76562
In the Linux kernel, the following vulnerability has been resolved: ceph: bound numexporttargets array for mds info v2/v3 cephmdsmapdecode in fs/ceph/mdsmap.c reads numexporttargets from each per-mds info record and advances the decode cursor by numexporttargets sizeofu32 without first checking...
EUVD-2026-76560
In the Linux kernel, the following vulnerability has been resolved: ceph: cap delegated inode count in cephparsedeleginos cephparsedeleginos decodes interval sets of delegated inode numbers from an MDS create-with-delegation reply. For each set it reads a 64-bit start and a 64-bit len with...
CVE-2026-89648
CVE-2026-89648 affects the Linux kernel Ceph filesystem client . The vulnerable function, ceph_parse_deleg_inos() , decodes delegated inode interval sets from MDS replies but performs no bounds check on the 64-bit len field, which is fully attacker-controlled. A malicious or compromised Ceph MDS ...
CVE-2026-89648 ceph: cap delegated inode count in ceph_parse_deleg_inos()
In the Linux kernel, the following vulnerability has been resolved: ceph: cap delegated inode count in cephparsedeleginos cephparsedeleginos decodes interval sets of delegated inode numbers from an MDS create-with-delegation reply. For each set it reads a 64-bit start and a 64-bit len with...
PT-2026-90368
In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS export get name ceph get name copies the MDS-supplied name into the caller's NAME MAX-sized buffer with memcpyname, rinfo-dname, rinfo-dname len and then writes namerinfo-dname len = 0...
PT-2026-90367
In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fs name decode in handle session handle session decodes the MDSCapAuth records carried by a CEPH SESSION OPEN message msg version = 6. For each record the match.path and match.fs name byte strings...
PT-2026-90366
In the Linux kernel, the following vulnerability has been resolved: ceph: bound num export targets array for mds info v2/v3 ceph mdsmap decode in fs/ceph/mdsmap.c reads num export targets from each per-mds info record and advances the decode cursor by num export targets sizeofu32 without first...
CVE-2026-80527
CVE-2026-80527 affects the Linux kernel's Ceph filesystem client (cephfs) . The vulnerability is in the capability state management within __ceph_get_caps(): the cap->mds_wanted field is updated before the corresponding CEPH_MSG_CLIENT_CAPS message is actually sent to the MDS, causing a stale ...
CVE-2026-80527 ceph: fix hanging __ceph_get_caps() with stale mds_wanted
In the Linux kernel, the following vulnerability has been resolved: ceph: fix hanging cephgetcaps with stale mdswanted A reader can hang forever in cephgetcaps when the client no longer holds FILERD, but local cap state still says that the capability is already wanted via mdswanted. One way to...