CVE-2026-89657 - Vulnerability Details

- libceph: validate OSD extent maps before cursor advance

Description

In the Linux kernel, the following vulnerability has been resolved:

libceph: validate OSD extent maps before cursor advance

net/ceph/osd_client.c:osd_sparse_read() validates that the sparse-read
data length matches the summed extent lengths, but it does not validate
that each OSD-supplied extent is monotonic and lies inside the original
request range. A malformed authenticated OSD reply can advertise a
far-forward nonzero extent offset with a matching data length and make
the client advance the message-data cursor beyond the request buffer.
This reaches the BUG_ON(!*length) assertion in ceph_msg_data_next() from
the client receive path.

Impact: A malicious or compromised authenticated Ceph OSD peer can crash
a kernel Ceph client via a malformed sparse-read reply.

Reject sparse extent maps that overflow, move backwards, overlap, or
extend outside the original sparse-read request before advancing the
cursor.

[ idryomov: perform sparse_extent_map_valid() check a bit earlier,
in CEPH_SPARSE_READ_DATA_LEN instead of CEPH_SPARSE_READ_DATA_PRE
state ]

Published: 2026-09-11

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability in the Linux kernel’s libceph OSD client allows a malicious reply to cause a buffer cursor to advance beyond the original read request boundary. This causes a BUG_ON assertion in ceph_msg_data_next(), leading to a kernel crash. The flaw is a classic out‑of‑bounds read, classified as CWE‑125, and results solely in a denial‑of‑service, not remote code execution.

Affected Systems

Any Linux distribution whose kernel includes the unpatched libceph path is potentially affected. The available CPE indicates the general Linux kernel, and the advis risk applies until the update that includes the extent‑map validation is installed.

Risk and Exploitability

The CVSS score of 7.5 reflects a high impact. The EPSS score is below 1 %, and the vulnerability is not yet listed in CISA’s KEV catalog, suggesting no widespread exploitation has been recorded. However, exploitation requires a compromised or malicious authenticated Ceph reply, a scenario that could occur in a mis‑configured Ceph cluster or when trust boundaries are breached.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`f628d799972799023d32c2542bb2639eb8c4f84e`	affected	< 94ae5145c520618802b0a24c047dcd5f05835db8
`f628d799972799023d32c2542bb2639eb8c4f84e`	affected	< 058ffa81f9440c5b4714685611cf697fd3739ec9
`f628d799972799023d32c2542bb2639eb8c4f84e`	affected	< 2571b35883268a266554e80d368e67fdfea7fb9d
`f628d799972799023d32c2542bb2639eb8c4f84e`	affected	< 201db408872ca12cf09e36bf0f560138c3dcfa1c
`f628d799972799023d32c2542bb2639eb8c4f84e`	affected	< 9ec08b7499a62c6d4afa93d36ab47a43fcad57d1

Linux

affected

Version	Status	Constraints
`6.6`	affected	—
`0`	unaffected	< 6.6
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[f628d799972799023d32c2542bb2639eb8c4f84e,058ffa81f9440c5b4714685611cf697fd3739ec9)`	affected	code_commit	—
`[f628d799972799023d32c2542bb2639eb8c4f84e,2571b35883268a266554e80d368e67fdfea7fb9d)`	affected	code_commit	—
`[f628d799972799023d32c2542bb2639eb8c4f84e,201db408872ca12cf09e36bf0f560138c3dcfa1c)`	affected	code_commit	—
`[f628d799972799023d32c2542bb2639eb8c4f84e,9ec08b7499a62c6d4afa93d36ab47a43fcad57d1)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.6`	affected	semver	—
`[0,6.6)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that incorporates the libceph extent‑map validation fix.
Configure the Ceph cluster to enforce strict authentication for all OSD communication, preventing unauthenticated or untrusted OSDs from sending replies.
Limit Ceph client nodes to peers, reducing exposure to the vulnerable code path.

Generated by OpenCVE AI on September 15, 2026 at 20:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0063.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/058ffa81f9440c5b4714685611cf697fd3739ec9
https://git.kernel.org/stable/c/201db408872ca12cf09e36bf0f560138c3dcfa1c
https://git.kernel.org/stable/c/2571b35883268a266554e80d368e67fdfea7fb9d
https://git.kernel.org/stable/c/94ae5145c520618802b0a24c047dcd5f05835db8
https://git.kernel.org/stable/c/9ec08b7499a62c6d4afa93d36ab47a43fcad57d1
https://nvd.nist.gov/vuln/detail/CVE-2026-89657
https://www.cve.org/CVERecord?id=CVE-2026-89657

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/94ae5145c520618802b0a24c047dcd5f05835db8

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89657 https://www.cve.org/CVERecord?id=CVE-2026-89657
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: libceph: validate OSD extent maps before cursor advance net/ceph/osd_client.c:osd_sparse_read() validates that the sparse-read data length matches the summed extent lengths, but it does not validate that each OSD-supplied extent is monotonic and lies inside the original request range. A malformed authenticated OSD reply can advertise a far-forward nonzero extent offset with a matching data length and make the client advance the message-data cursor beyond the request buffer. This reaches the BUG_ON(!*length) assertion in ceph_msg_data_next() from the client receive path. Impact: A malicious or compromised authenticated Ceph OSD peer can crash a kernel Ceph client via a malformed sparse-read reply. Reject sparse extent maps that overflow, move backwards, overlap, or extend outside the original sparse-read request before advancing the cursor. [ idryomov: perform sparse_extent_map_valid() check a bit earlier, in CEPH_SPARSE_READ_DATA_LEN instead of CEPH_SPARSE_READ_DATA_PRE state ]
Title		libceph: validate OSD extent maps before cursor advance
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/058ffa81f9440c5b4714685611cf697fd3739ec9 https://git.kernel.org/stable/c/201db408872ca12cf09e36bf0f560138c3dcfa1c https://git.kernel.org/stable/c/2571b35883268a266554e80d368e67fdfea7fb9d https://git.kernel.org/stable/c/9ec08b7499a62c6d4afa93d36ab47a43fcad57d1

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:45:46.118Z

Updated: 2026-09-14T12:01:51.323Z

Reserved: 2026-09-11T19:38:34.743Z

Link: CVE-2026-89657

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:51.940

Modified: 2026-09-14T13:19:18.230

Link: CVE-2026-89657

Redhat

Severity : Important

Publid Date: 2026-09-11T19:45:46Z

Links: CVE-2026-89657 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T21:00:17Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object