CVE-2026-89649

CVE-2026-89649 affects the Linux kernel's CephFS subsystem. The function __build_xattrs() decodes xattr blobs supplied by the Ceph metadata server (MDS) but fails to verify that the final attribute's value length does not exceed the remaining bytes in the blob — it advances the pointer with a bar...