CVE-2026-89653

What it actually does

Out-of-bounds write via set_bit() on a fixed-size stack bitmap when an MDSMap export_targets entry contains a rank >= CEPH_MAX_MDS during map decoding in the Ceph client.

Why it matters to the business

Remote attackers can crash affected Linux systems or potentially execute arbitrary code with kernel privileges, leading to full host compromise, data loss, or service disruption in Ceph-dependent storage environments.

How an attack unfolds

An attacker supplies a crafted MDSMap (via network or compromised monitor) containing an export_targets entry with an out-of-range rank; check_new_map() passes this value directly to set_bit(), writing past the bitmap end and corrupting adjacent kernel memory.

How to fix it

Update to a Linux kernel version containing the fix that rejects ranks >= CEPH_MAX_MDS during MDSMap decoding; rebuild and reboot systems using Ceph; apply vendor-supplied kernel packages as soon as available.

How to confirm the fix worked

Confirm kernel source contains the rank check before set_bit() in mdsmap decode; test with a crafted MDSMap containing high rank values and verify no panic or corruption occurs; monitor for upstream Ceph kernel backports.

Typical attack path

1. Obtain network access to Ceph client or monitor communication path
2. Craft or intercept an MDSMap containing export_targets rank >= CEPH_MAX_MDS
3. Trigger map decode on target kernel via normal Ceph operations or map update
4. Cause set_bit() out-of-bounds write leading to memory corruption
5. Leverage corruption for denial of service or privilege escalation

How to detect it

Search kernel logs for Ceph MDSMap decode errors or out-of-bounds warnings; look for unexpected set_bit or bitmap corruption panics in dmesg; monitor Ceph client map update events for anomalous rank values.

What your security team should do

• Prioritize kernel updates on all Ceph client nodes due to critical CVSS and network attack vector
• Restrict Ceph monitor and MDS network exposure to trusted hosts only
• Enable kernel memory corruption detection features such as KASAN in test environments
• Review Ceph deployment for any custom map handling or untrusted monitor configurations