CVE-2026-89653: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ceph: reject exporttargets ranks = CEPHMAXMDS in mdsmap decode MDSMap exporttargets entries are monitor controlled. checknewmap uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can...

PT-2026-90369

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ceph component where the check new map function uses entries from export targets as bit numbers in a fixed stack bitmap. Because these entries are monitor...

CVE-2026-89651: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fsname decode in handlesession handlesession decodes the MDSCapAuth records carried by a CEPHSESSIONOPEN message msgversion = 6. For each record the match.path and match.fsname byte strings are rea...

PT-2026-96387

In the Linux kernel, the following vulnerability has been resolved: ceph: do not repeat ceph trim dentries if no progress possible ceph cap reclaim work re-queues itself for as long as ceph trim dentries returns -EAGAIN, which happens whenever a lease walk exhausts its nr to scan budget. This...

CVE-2026-89654: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in checknewmap on session freed during unlock checknewmap iterates mdsc-sessions and for each active session drops mdsc-mutex to perform per-session operations. The forced-close path rank removed from map correctly...

PT-2026-90370

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the ceph component of the Linux kernel within the check new map function. The function iterates through mdsc-sessions and releases mdsc-mutex to...

CVE-2026-89646: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount cephdirtyfolio takes a wrbuffer claim on each newly dirtied folio: it bumps iwrbufferref taking an ihold on the 0-1 transition and attaches the snapcontext to...

PT-2026-90362

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Ceph component of the Linux kernel where an inode reference is leaked during a writeback abort during unmount. The ceph dirty folio function creates a wrbuffer cla...

PT-2026-90364

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel's Ceph implementation where the ceph parse deleg inos function fails to validate the value of the len variable when decoding interval sets of delegate...

PT-2026-90363

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A busy loop occurs in the Ceph component of the Linux kernel when ceph cap reclaim work repeatedly re-queues itself because ceph trim dentries returns -EAGAIN. This happens when a lease...

CVE-2026-89647: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ceph: do not repeat cephtrimdentries if no progress possible cephcapreclaimwork re-queues itself for as long as cephtrimdentries returns -EAGAIN, which happens whenever a lease walk exhausts its nrtoscan budget. This creates a bu...

PT-2026-90367

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the handle session function when decoding MDSCapAuth records within a CEPH SESSION OPEN message. The function uses ceph decode copy to read the match.path...

PT-2026-90371

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the ceph component of the Linux kernel. The kick flushing caps function iterates through the ci-i cap flush list using list for each entry but releas...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107272)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107272 advisory. In the Linux kernel, the following vulnerability has been resolved: ceph: blocklist the kclient when receiving corrupted snap trace When received corrupted snap trac...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107263)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107263 advisory. In the Linux kernel, the following vulnerability has been resolved: ceph: drop messages from MDS when unmounting When unmounting all the dirty buffers will be flushe...

PT-2026-90366

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the CephFS client kernel when processing CEPH MSG MDS MAP messages. The function ceph mdsmap decode in fs/ceph/mdsmap.c reads the num export targets...

CVE-2026-89648: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ceph: cap delegated inode count in cephparsedeleginos cephparsedeleginos decodes interval sets of delegated inode numbers from an MDS create-with-delegation reply. For each set it reads a 64-bit start and a 64-bit len with...

CVE-2026-89650: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ceph: bound numexporttargets array for mds info v2/v3 cephmdsmapdecode in fs/ceph/mdsmap.c reads numexporttargets from each per-mds info record and advances the decode cursor by numexporttargets sizeofu32 without first checking...

CVE-2026-89652: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS export getname cephgetname copies the MDS-supplied name into the caller's NAMEMAX-sized buffer with memcpyname, rinfo-dname, rinfo-dnamelen and then writes namerinfo-dnamelen = 0,...

Updated ceph packages fix security vulnerabilities

Updated ceph packages fix various security issues allowing authentication bypasses to gain admin privileges on the OSD, MDS, and MGR services. Notice that some of the fixes require kernel support for aes256k introduced in kernel 7. This update will not break installs using the old and insecure AE...