CVE-2026-89653 ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode

In the Linux kernel, the following vulnerability has been resolved: ceph: reject exporttargets ranks = CEPHMAXMDS in mdsmap decode MDSMap exporttargets entries are monitor controlled. checknewmap uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can...

CVE-2026-89653

This vulnerability affects the Linux kernel's Ceph filesystem (ceph) MDSMap decode path . The check_new_map() function uses monitor-controlled export_targets entries as bit numbers in a fixed stack bitmap. A rank value at or above CEPH_MAX_MDS causes set_bit() to write past the end of the array, ...

PT-2026-90366

In the Linux kernel, the following vulnerability has been resolved: ceph: bound num export targets array for mds info v2/v3 ceph mdsmap decode in fs/ceph/mdsmap.c reads num export targets from each per-mds info record and advances the decode cursor by num export targets sizeofu32 without first...