CVE-2026-89653ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode MDSMap export_targets entries are monitor controlled. check_new_map() uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can make set_bit() write past the end of the array. Reject ranks outside CEPH_MAX_MDS while decoding the map. Do not validate against possible_max_rank here because maps may legitimately reference ranks beyond a temporarily reduced max_mds.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from d517b3983dd3106ca92d6c5d0d09415a4a09481c before 3740c88ca9cb2210a8dbdd55ea4cec119fbe86fe; from d517b3983dd3106ca92d6c5d0d09415a4a09481c before 8c823bbab3c24e657469a84db96902ba82d4e8bb; from d517b3983dd3106ca92d6c5d0d09415a4a09481c before c4addccd05bacbef2144b4db14853d0308a218ac; from d517b3983dd3106ca92d6c5d0d09415a4a09481c before 736adee11af36e407ed902264f8b2fb5cf94b62f; from d517b3983dd3106ca92d6c5d0d09415a4a09481c before 4d298880f82c42383b36946bafde7ccf4d804c9b; from d517b3983dd3106ca92d6c5d0d09415a4a09481c before 96c3f5fbb0d5386e7111426f047f98cec4586674; from d517b3983dd3106ca92d6c5d0d09415a4a09481c before aedc9053d909508a5f56c3f49f885fc030df4730 | CNA record |
References
- https://git.kernel.org/stable/c/3740c88ca9cb2210a8dbdd55ea4cec119fbe86fe
- https://git.kernel.org/stable/c/8c823bbab3c24e657469a84db96902ba82d4e8bb
- https://git.kernel.org/stable/c/c4addccd05bacbef2144b4db14853d0308a218ac
- https://git.kernel.org/stable/c/736adee11af36e407ed902264f8b2fb5cf94b62f
- https://git.kernel.org/stable/c/4d298880f82c42383b36946bafde7ccf4d804c9b
- https://git.kernel.org/stable/c/96c3f5fbb0d5386e7111426f047f98cec4586674
- https://git.kernel.org/stable/c/aedc9053d909508a5f56c3f49f885fc030df4730
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.