External risk intelligence

Linux kernel libceph CRUSH ID Mismatch Out-of-Bounds Write

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-89656

This vulnerability exists within the Linux kernel's Ceph filesystem client (libceph). While kernel code is network-reachable, this specific component handles CRUSH map decoding for distributed storage clusters. It is typically accessed only within internal, trusted storage network environments, making direct public internet exposure uncommon.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This Linux kernel vulnerability involves how the Ceph storage system handles certain data structures. A malformed input could potentially lead to a buffer overflow, impacting the integrity and availability of the storage system. The primary concern at this time is to confirm if your environment utilizes this specific component and is exposed to such malformed data.

Issue with storage data handling.
Matters for data integrity and availability.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by providing a malformed CRUSH map to a system using the Linux kernel's Ceph client. This would trick the system into misinterpreting bucket IDs, potentially causing it to write data beyond allocated memory. This could lead to a critical system crash or allow an attacker to execute arbitrary code.

Network access to a Ceph cluster is required.
A malformed CRUSH map triggers the vulnerability.
Arbitrary code execution or system crash risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's Ceph client could allow an attacker to corrupt memory when processing a malformed CRUSH map. This memory corruption could potentially lead to system instability or unauthorized data modification.

Kernel memory corruption is at risk.
Exposure occurs via a malformed CRUSH map.
System instability or data modification may result.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides within the Linux kernel's Ceph filesystem client (libceph). Responsibility for addressing this issue likely falls to the infrastructure or platform teams managing the Ceph storage environment, in coordination with the system owners responsible for the affected hosts. The first practical step is to identify all hosts running the affected kernel version, confirm their exposure to untrusted input or network access, and then plan remediation.

Infrastructure and platform teams own remediation.
Verify Ceph cluster and host exposure.
Plan kernel updates during maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is libceph in the Linux kernel?

libceph is the component within the Linux kernel that provides client-side support for Ceph, a distributed storage system. It handles network communication and data placement logic, specifically using CRUSH maps to determine where data is stored across a cluster of storage devices. Users rely on it to mount and interact with CephFS or RBD block devices.

What is the vulnerability in CVE-2026-89656?

This is an out-of-bounds write vulnerability. The code responsible for decoding CRUSH maps fails to verify that a bucket's ID matches its designated array slot. An attacker can supply a malformed map that confuses the system's memory management, causing it to write data into memory space reserved for different buckets, which can corrupt system memory.

How is this vulnerability triggered?

An attacker must provide a malformed CRUSH map to a system using the affected libceph client. Normal, well-formed maps that use the standard, expected bucket ID format do not trigger this memory corruption. The issue specifically occurs when a map contains conflicting or mismatched IDs that mislead the kernel's workspace index calculations.

Is my system at risk for CVE-2026-89656?

According to Halo Surface Signal, risk is unlikely because libceph handles internal traffic for storage clusters rather than public internet requests. If your Ceph storage network is isolated from untrusted or public input, the chance of an attacker successfully delivering a malicious CRUSH map is significantly reduced.

How do I respond to this Linux kernel issue?

Begin by auditing your infrastructure to identify which hosts are running affected kernel versions that interact with Ceph clusters. Coordinate with your platform teams to prioritize patching these kernels. Since this involves core system memory handling, plan to apply the necessary kernel updates during your next scheduled maintenance window.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.