External risk intelligence

Linux Kernel Ceph Out-of-Bounds Read Vulnerability in MDS Map Handling

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-89650

This vulnerability resides in the Linux kernel's Ceph client, requiring communication from a Ceph monitor. Ceph clusters are typically deployed within private, trusted infrastructure. Public exposure of a Ceph monitor session is uncommon, as these services are designed for internal storage fabric management rather than direct public-facing internet access.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the Linux kernel related to the Ceph distributed storage system, specifically affecting how it handles information about metadata servers. This issue could allow a compromised or malicious monitor to trigger an out-of-bounds read in the CephFS client kernel, which is a critical security concern. The primary concern for leadership is to confirm if this specific technology is in use and if there is any exposure.

Kernel code allows reading past buffer limits.
Confirms if CephFS client technology is in use.
Assess relevance and potential exposure to your systems.

Attack Path

How an attacker could exploit the issue

An attacker could trigger a kernel out-of-bounds read by sending a specially crafted message to a CephFS client. This message, an MDS map, would come from a Ceph monitor. If the monitor is compromised or the communication channel is not secured, the attacker could manipulate the `num_export_targets` field within the message to cause the CephFS client to read beyond its allocated memory buffer.

Requires access to Ceph monitor.
Triggers with oversized export targets.
Results in kernel out-of-bounds read.

Live Threat

Current exploitation, exposure, and threat context

A malicious or compromised Ceph monitor could trigger an out-of-bounds read in the CephFS client kernel when processing an MDS map with specific older versions. This affects the internal `export_targets` array within the client's memory.

CephFS client kernel memory.
Malicious monitor sends crafted MDS map.
Kernel out-of-bounds read.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides in the Linux kernel's Ceph client, specifically when processing MDS map information from a Ceph monitor. Real-world response efforts will likely involve infrastructure teams managing Ceph deployments and potentially security teams if unencrypted or unsigned Ceph monitor sessions are in use. The first practical step is to identify Ceph clients, confirm their exposure to potentially malicious monitors, and then plan remediation.

Infrastructure and security teams own this.
Verify Ceph monitor session security.
Plan remediation based on exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel Ceph client?

The Ceph client is a component within the Linux kernel that allows a computer to mount and interact with Ceph distributed storage. It acts as the bridge between the operating system and the storage cluster, enabling applications to read and write files directly to the networked file system known as CephFS.

What is the vulnerability in CVE-2026-89650?

This is an out-of-bounds read vulnerability. It occurs because the kernel fails to verify that the amount of data provided in a network message matches the expected buffer size. If the message claims to have more information than the buffer can hold, the kernel reads memory outside its assigned boundary.

How is this vulnerability triggered?

An attacker must control or compromise a Ceph monitor to send a malformed MDS map message. The flaw is specifically triggered when using older MDS map versions (v2 or v3) containing an oversized export-targets field. Standard traffic, or traffic using newer protocol versions, does not trigger this specific memory access error.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal labels this as unlikely because the flaw requires direct interaction with a Ceph monitor. These monitors manage storage fabric internals and are rarely exposed to the public internet. Most Ceph clusters operate within private, trusted network segments, which naturally limits who can send the required malicious instructions.

What should I do to address this issue?

First, identify which systems in your environment are running the CephFS client kernel module. Once identified, ensure your network security policies strictly isolate Ceph traffic. Because this is a kernel-level flaw, you should coordinate with infrastructure teams to plan for kernel updates that include the necessary bounds-checking logic.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.