Cloudanix VulnDB

CVE-2026-89656

Critical · 9.8

CVSS

9.8

EPSS

0.5%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in how Linux handles certain storage configuration data can let attackers corrupt memory and potentially take over or crash systems that use Ceph storage.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Malformed CRUSH map causes bucket id mismatch, leading to workspace aliasing and out-of-bounds write of 4 bytes in bucket_perm_choose() during uniform bucket replica selection.

Why it matters to the business

Kernel memory corruption in Ceph-using Linux systems can enable remote code execution or crashes, disrupting storage services and risking data integrity or availability in affected clusters.

How an attack unfolds

An attacker supplies a malicious CRUSH map containing a bucket whose encoded id differs from its array slot; during crush_decode and subsequent mapping, the aliased workspace buffer is overwritten beyond its bounds when selecting replicas.

How to fix it

Apply the upstream kernel patch that rejects buckets whose encoded id does not match their array slot; rebuild and deploy the fixed kernel to all Ceph nodes.

How to confirm the fix worked

Confirm the presence of the reject logic in crush_decode() and absence of KASAN reports for bucket_perm_choose() under malformed map testing; verify kernel build includes the fix commit.

Typical attack path

  1. Obtain or craft a Ceph CRUSH map with mismatched bucket ids
  2. Deliver the map to a vulnerable libceph instance via OSD or client communication
  3. Trigger CRUSH mapping operations involving uniform buckets of differing sizes
  4. Exploit the resulting slab OOB write for code execution or denial of service

How to detect it

Inspect kernel logs and KASAN output for slab OOB writes referencing bucket_perm_choose or CRUSH workspace; correlate with Ceph map decoding events or unexpected OSD/client restarts.

  • slab OOB write of 4 bytes in bucket_perm_choose()
  • KASAN: slab-out-of-bounds in libceph
  • work->work[-1 - in->id] aliasing

What your security team should do

  • Prioritize kernel updates on all Ceph clients and OSD hosts
  • Monitor for unexpected kernel crashes or OOB write reports in system logs
  • Restrict untrusted CRUSH map ingestion until patched
  • Test Ceph map validation in staging before production rollout

The record

In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crush_decode() stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the decoded bucket id. A malformed map can therefore make one bucket reuse another bucket's workspace by encoding an id different from -1 - slot. For uniform buckets, the second replica selection expands the source bucket's permutation into that aliased workspace buffer. If the source bucket is larger than the aliased bucket, the write runs past the smaller permutation array and can escape the kvmalloc'd CRUSH workspace. KASAN reports a slab OOB write of 4 bytes in bucket_perm_choose(). Reject buckets whose encoded id does not match their array slot. Valid CRUSH maps already use the canonical negative id corresponding to the bucket slot, so this restores the invariant expected by work->work[-1 - in->id] without changing valid map behavior.

Affected packages

Ecosystem Package Introduced Fixed