CVE-2026-89656 - Vulnerability Details

- libceph: reject buckets with mismatched CRUSH ids

Description

In the Linux kernel, the following vulnerability has been resolved:

libceph: reject buckets with mismatched CRUSH ids

crush_decode() stores bucket data by array slot, and the mapper later
derives the per-bucket workspace index from the decoded bucket id. A
malformed map can therefore make one bucket reuse another bucket's
workspace by encoding an id different from -1 - slot.

For uniform buckets, the second replica selection expands the source
bucket's permutation into that aliased workspace buffer. If the source
bucket is larger than the aliased bucket, the write runs past the smaller
permutation array and can escape the kvmalloc'd CRUSH workspace. KASAN
reports a slab OOB write of 4 bytes in bucket_perm_choose().

Reject buckets whose encoded id does not match their array slot. Valid
CRUSH maps already use the canonical negative id corresponding to the
bucket slot, so this restores the invariant expected by
work->work[-1 - in->id] without changing valid map behavior.

Published: 2026-09-11

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A malformed CRUSH map in the Linux kernel causes the bucket decoder to store bucket data in a bucket's workspace buffer based on an encoded bucket id that does not match its array slot. The later reuse of that workspace by the mapper results in a 4‑byte out‑of‑bounds write within the kernel’s kvmalloc‑allocated CRUSH structures, leading to kernel memory corruption.

Affected Systems

The vulnerability affects the Linux kernel, specifically any distribution or build that includes the libceph subsystem and has not yet applied the fixes contained in the referenced commits. No precise version range is listed, so all current kernels incorporating libceph remain potentially exposed until the patch is deployed.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.8, indicating a critical severity level. The EPSS score is less than 1 %, suggesting a low current likelihood of exploitation, and it is not listed in the CISA KEV catalog. The attack vector likely requires an attacker to supply a malformed CRUSH map to a Ceph cluster, such as by modifying cluster configuration or a Ceph client with map editing permissions. The out‑of‑bounds write in bucket_perm_choose() can corrupt kernel memory, which could lead to a crash or, if an attacker can supply executable code, potentially arbitrary execution with kernel privileges. These consequences are inferred from typical kernel memory corruption outcomes.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`66a0e2d579dbec5c676cfe446234ffebb267c564`	affected	< ee59040d6ed1a5f8d10d27174b8f32c90ca8e89a
`66a0e2d579dbec5c676cfe446234ffebb267c564`	affected	< baad5875fdd2f5e248250fc3519bb045d64f1716
`66a0e2d579dbec5c676cfe446234ffebb267c564`	affected	< 4aeb93daadf388e72073abc204312dd364eeb30a
`66a0e2d579dbec5c676cfe446234ffebb267c564`	affected	< 6e5c6ce252b1eccfd41670a5cf95ab44f7ba7022
`66a0e2d579dbec5c676cfe446234ffebb267c564`	affected	< 3516a4131c4e45d62ee4e42e82c36930e8c1fbbd
`66a0e2d579dbec5c676cfe446234ffebb267c564`	affected	< 00562ccd4e88d092b9b851df50fad20442bfeb24
`66a0e2d579dbec5c676cfe446234ffebb267c564`	affected	< 79900d978158b2d80eef952fc41b9e4dc58d7b83
`66a0e2d579dbec5c676cfe446234ffebb267c564`	affected	< 3cde4a8302301679937474a5f7a851394cc1bd11

Linux

affected

Version	Status	Constraints
`4.11`	affected	—
`0`	unaffected	< 4.11
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[66a0e2d579dbec5c676cfe446234ffebb267c564,3516a4131c4e45d62ee4e42e82c36930e8c1fbbd)`	affected	code_commit	—
`[66a0e2d579dbec5c676cfe446234ffebb267c564,00562ccd4e88d092b9b851df50fad20442bfeb24)`	affected	code_commit	—
`[66a0e2d579dbec5c676cfe446234ffebb267c564,79900d978158b2d80eef952fc41b9e4dc58d7b83)`	affected	code_commit	—
`[66a0e2d579dbec5c676cfe446234ffebb267c564,3cde4a8302301679937474a5f7a851394cc1bd11)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.11`	affected	generic	—
`[0,4.11)`	unaffected	semver	—
`[6.12.109,7.0.0)`	unaffected	semver	—
`[6.18.50,7.0.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Linux kernel update that incorporates the libceph bucket‑id validation fix.
Verify that all Ceph maps use the canonical negative bucket IDs expected by the kernel; reject any maps that encode IDs inconsistent with their array slots.
Restrict privileges for modifying Ceph maps to trusted administrators to reduce the chance of malicious malformed maps entering the cluster.

Generated by OpenCVE AI on September 15, 2026 at 21:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00755.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/00562ccd4e88d092b9b851df50fad20442bfeb24
https://git.kernel.org/stable/c/3516a4131c4e45d62ee4e42e82c36930e8c1fbbd
https://git.kernel.org/stable/c/3cde4a8302301679937474a5f7a851394cc1bd11
https://git.kernel.org/stable/c/4aeb93daadf388e72073abc204312dd364eeb30a
https://git.kernel.org/stable/c/6e5c6ce252b1eccfd41670a5cf95ab44f7ba7022
https://git.kernel.org/stable/c/79900d978158b2d80eef952fc41b9e4dc58d7b83
https://git.kernel.org/stable/c/baad5875fdd2f5e248250fc3519bb045d64f1716
https://git.kernel.org/stable/c/ee59040d6ed1a5f8d10d27174b8f32c90ca8e89a
https://nvd.nist.gov/vuln/detail/CVE-2026-89656
https://www.cve.org/CVERecord?id=CVE-2026-89656

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/4aeb93daadf388e72073abc204312dd364eeb30a https://git.kernel.org/stable/c/6e5c6ce252b1eccfd41670a5cf95ab44f7ba7022 https://git.kernel.org/stable/c/baad5875fdd2f5e248250fc3519bb045d64f1716 https://git.kernel.org/stable/c/ee59040d6ed1a5f8d10d27174b8f32c90ca8e89a

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 17:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119

Sat, 12 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89656 https://www.cve.org/CVERecord?id=CVE-2026-89656
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H'}` threat_severity `Important`

Sat, 12 Sep 2026 07:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crush_decode() stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the decoded bucket id. A malformed map can therefore make one bucket reuse another bucket's workspace by encoding an id different from -1 - slot. For uniform buckets, the second replica selection expands the source bucket's permutation into that aliased workspace buffer. If the source bucket is larger than the aliased bucket, the write runs past the smaller permutation array and can escape the kvmalloc'd CRUSH workspace. KASAN reports a slab OOB write of 4 bytes in bucket_perm_choose(). Reject buckets whose encoded id does not match their array slot. Valid CRUSH maps already use the canonical negative id corresponding to the bucket slot, so this restores the invariant expected by work->work[-1 - in->id] without changing valid map behavior.
Title		libceph: reject buckets with mismatched CRUSH ids
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/00562ccd4e88d092b9b851df50fad20442bfeb24 https://git.kernel.org/stable/c/3516a4131c4e45d62ee4e42e82c36930e8c1fbbd https://git.kernel.org/stable/c/3cde4a8302301679937474a5f7a851394cc1bd11 https://git.kernel.org/stable/c/79900d978158b2d80eef952fc41b9e4dc58d7b83

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:45:45.483Z

Updated: 2026-09-14T12:01:50.256Z

Reserved: 2026-09-11T19:38:34.743Z

Link: CVE-2026-89656

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:51.813

Modified: 2026-09-14T13:19:18.080

Link: CVE-2026-89656

Redhat

Severity : Important

Publid Date: 2026-09-11T19:45:45Z

Links: CVE-2026-89656 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T21:30:16Z

Weaknesses

CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object