CVE-2026-90067 - Vulnerability Details

- libceph: validate banner payload length

Description

In the Linux kernel, the following vulnerability has been resolved:

libceph: validate banner payload length

When parsing the Ceph messenger v2 protocol banner, the `payload_len` field
is decoded from the banner prefix. If a client sends a banner with a
`payload_len` of 0, the kernel sets up a 0-length socket read. This
violates an invariant in the state machine, triggering a warning in
`populate_in_iter()`:

------------[ cut here ]------------
!iov_iter_count(&con->v2.in_iter)
WARNING: net/ceph/messenger_v2.c:3129 at populate_in_iter
net/ceph/messenger_v2.c:3129 [inline], CPU#1: kworker/1:3/5070
WARNING: net/ceph/messenger_v2.c:3129 at ceph_con_v2_try_read+0x6634/0x6810
net/ceph/messenger_v2.c:3159, CPU#1: kworker/1:3/5070
...
Call Trace:
<TASK>
ceph_con_workfn+0x1f5/0x14a0 net/ceph/messenger.c:1575
process_one_work kernel/workqueue.c:3322 [inline]
process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>

According to the msgr2 protocol specification, the banner payload is
expected to contain at least two 64-bit integers (`server_feat` and
`server_req_feat`). Therefore, `payload_len` must be at least 16 bytes.

Fix this by adding a check in `process_banner_prefix()` to reject a
`payload_len` smaller than 16 bytes. This prevents the 0-length read and
correctly aborts the connection with a protocol error.

Published: 2026-09-17

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A missing validation in the Ceph messenger v2 banner parsing allows a client to send a banner with a payload length of zero. The kernel then performs a zero‑length socket read, violating an invariant in the state machine and emitting a warning. While the fix simply aborts the connection with a protocol error, the exposed bug represents an improper input validation flaw that could be abused to disrupt Ceph communication between nodes.

Affected Systems

The flaw resides in the Linux kernel’s Ceph messenger v2 implementation and affects all kernel versions that do not contain the commit adding the payload length check. The affected product is Linux kernel; specific versions are not listed in the available data.

Risk and Exploitability

With a CVSS score of 7.5 the vulnerability is considered medium‑high severity. The EPSS score of less than 1% indicates a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be network‑based: a malicious Ceph client or node that can reach the kernel’s Ceph interface can send a malformed banner. Successful exploitation would abort the connection, potentially degrading availability of the affected Ceph cluster.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`cd1a677cad994021b19665ed476aea63f5d54f31`	affected	< 279c0852999fd2384f4a88155091a99e81f96873
`cd1a677cad994021b19665ed476aea63f5d54f31`	affected	< 6cf666e47f2b51d5a887ec8a3226cde951757d27
`cd1a677cad994021b19665ed476aea63f5d54f31`	affected	< 3b2e62a7655d347a845a91155610ddae11daffc6
`cd1a677cad994021b19665ed476aea63f5d54f31`	affected	< c1b937ff24b19e69aa7fb1b0f46a74d4c9668692
`cd1a677cad994021b19665ed476aea63f5d54f31`	affected	< 6d1c6f228854aa89844fd0152d7ed7ac72a55e89
`cd1a677cad994021b19665ed476aea63f5d54f31`	affected	< c77633a9595658210a6e216a071e5a396a0835a7
`cd1a677cad994021b19665ed476aea63f5d54f31`	affected	< f374967fcdf04001c9b66df1c19106fa83cd91f7

Linux

affected

Version	Status	Constraints
`5.11`	affected	—
`0`	unaffected	< 5.11
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[cd1a677cad994021b19665ed476aea63f5d54f31,279c0852999fd2384f4b88155091a99e81f96873)`	affected	code_commit	—
`[cd1a677cad994021b19665ed476aea63f5d54f31,6cf666e47f2b51d5a887ec8a3226cde951757d27)`	affected	code_commit	—
`[cd1a677cad994021b19665ed476aea63f5d54f31,3b2e62a7655d347a845a91155610ddae11daffc6)`	affected	code_commit	—
`[cd1a677cad994021b19665ed476aea63f5d54f31,c1b937ff24b19e69aa7fb1b0f46a74d4c9668692)`	affected	code_commit	—
`[cd1a677cad994021b19665ed476aea63f5d54f31,6d1c6f228854aa89844fd0152d7ed7ac72a55e89)`	affected	code_commit	—
`[cd1a677cad994021b19665ed476aea63f5d54f31,c77633a9595658210a6e216a071e5a396a0835a7)`	affected	code_commit	—
`[cd1a677cad994021b19665ed476aea63f5d54f31,f374967fcdf04001c9b66df1c19106fa83cd91f7)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.11`	affected	semver	—
`[0,5.11)`	unaffected	semver	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.52,6.19.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the patch adding a payload length check for Ceph messenger v2
Restrict Ceph traffic to authorized hosts, using firewall rules or network segmentation to prevent unauthorized nodes from composing malformed banners
Monitor kernel logs for ‘populate_in_iter’ or Ceph banner warnings and investigate any anomalies that may indicate attempted abuse

Generated by OpenCVE AI on September 20, 2026 at 03:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.007.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/279c0852999fd2384f4a88155091a99e81f96873
https://git.kernel.org/stable/c/3b2e62a7655d347a845a91155610ddae11daffc6
https://git.kernel.org/stable/c/6cf666e47f2b51d5a887ec8a3226cde951757d27
https://git.kernel.org/stable/c/6d1c6f228854aa89844fd0152d7ed7ac72a55e89
https://git.kernel.org/stable/c/c1b937ff24b19e69aa7fb1b0f46a74d4c9668692
https://git.kernel.org/stable/c/c77633a9595658210a6e216a071e5a396a0835a7
https://git.kernel.org/stable/c/f374967fcdf04001c9b66df1c19106fa83cd91f7

History

Sun, 20 Sep 2026 04:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20

Fri, 18 Sep 2026 21:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Thu, 17 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: libceph: validate banner payload length When parsing the Ceph messenger v2 protocol banner, the `payload_len` field is decoded from the banner prefix. If a client sends a banner with a `payload_len` of 0, the kernel sets up a 0-length socket read. This violates an invariant in the state machine, triggering a warning in `populate_in_iter()`: ------------[ cut here ]------------ !iov_iter_count(&con->v2.in_iter) WARNING: net/ceph/messenger_v2.c:3129 at populate_in_iter net/ceph/messenger_v2.c:3129 [inline], CPU#1: kworker/1:3/5070 WARNING: net/ceph/messenger_v2.c:3129 at ceph_con_v2_try_read+0x6634/0x6810 net/ceph/messenger_v2.c:3159, CPU#1: kworker/1:3/5070 ... Call Trace: <TASK> ceph_con_workfn+0x1f5/0x14a0 net/ceph/messenger.c:1575 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> According to the msgr2 protocol specification, the banner payload is expected to contain at least two 64-bit integers (`server_feat` and `server_req_feat`). Therefore, `payload_len` must be at least 16 bytes. Fix this by adding a check in `process_banner_prefix()` to reject a `payload_len` smaller than 16 bytes. This prevents the 0-length read and correctly aborts the connection with a protocol error.
Title		libceph: validate banner payload length
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/279c0852999fd2384f4a88155091a99e81f96873 https://git.kernel.org/stable/c/3b2e62a7655d347a845a91155610ddae11daffc6 https://git.kernel.org/stable/c/6cf666e47f2b51d5a887ec8a3226cde951757d27 https://git.kernel.org/stable/c/6d1c6f228854aa89844fd0152d7ed7ac72a55e89 https://git.kernel.org/stable/c/c1b937ff24b19e69aa7fb1b0f46a74d4c9668692 https://git.kernel.org/stable/c/c77633a9595658210a6e216a071e5a396a0835a7 https://git.kernel.org/stable/c/f374967fcdf04001c9b66df1c19106fa83cd91f7

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-17T16:05:49.600Z

Updated: 2026-09-18T17:52:51.640Z

Reserved: 2026-09-11T19:38:34.784Z

Link: CVE-2026-90067

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-17T17:16:55.553

Modified: 2026-09-18T18:17:40.537

Link: CVE-2026-90067

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-20T04:00:09Z

Weaknesses

CWE-20
Improper Input Validation

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object