PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-89648 Linux CVE debrief

A vulnerability in the Linux kernel's ceph_parse_deleg_inos() function allows an attacker to cause a denial of service by providing a large number of delegated inodes, which can lead to an unbounded growth of the delegated inode count. This issue affects Linux kernel developers and administrators who use the ceph storage system, as they should assess their exposure to this vulnerability and apply the provided patches to fix the issue. The vulnerability is caused by a lack of input validation in the ceph_parse_deleg_inos() function.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-11
Original CVE updated
2026-10-21
Advisory published
2026-09-11
Advisory updated
2026-10-21

Who should care

Linux kernel developers and administrators who use the ceph storage system should assess their exposure to this vulnerability and apply the provided patches to fix the issue. They should review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra review.

Why it matters

This vulnerability allows an attacker to cause a denial of service by providing a large number of delegated inodes, which can lead to an unbounded growth of the delegated inode count. Linux kernel developers and administrators who use the ceph storage system should assess their exposure to this vulnerability and apply the provided patches to fix the issue.

  • Denial of service due to unbounded growth of delegated inode count
  • Potential for system crashes or freezes due to excessive resource usage

Technical summary

The vulnerability is caused by a lack of input validation in the ceph_parse_deleg_inos() function, which allows an attacker to provide a large number of delegated inodes. This can lead to an unbounded growth of the delegated inode count, causing a denial of service. The vulnerability affects Linux kernel developers and administrators who use the ceph storage system, as they should assess their exposure to this vulnerability and apply the provided patches to fix the issue. The vulnerability can be mitigated by reviewing and applying the provided patches, updating the Linux kernel to a version that includes the fix, and monitoring system logs for potential denial of service attacks.

Defensive priority

Medium

Recommended defensive actions

  • Review and apply the provided patches to fix the vulnerability
  • Update Linux kernel to a version that includes the fix
  • Monitor system logs for potential denial of service attacks
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by a lack of input validation in the ceph_parse_deleg_inos() function, which allows an attacker to provide a large number of delegated inodes. This can lead to an unbounded growth of the delegated inode count, causing a denial of service. Linux kernel developers and administrators who use the ceph storage system should assess their exposure to this vulnerability and apply the provided patches to fix the issue.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-89648 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-89648

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-89648 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-89648

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • ceph: cap delegated inode count in ceph_parse_deleg_inos()

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89648.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8194d8e61ef0b49baddf660c7e88fc1c563a5e55

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/7fc55e8e6b6b50f217b1728415578704baf4d0a2

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c040e139f1a629b767f900bbbc3f9892c290ed85

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f341270ac5f5077804d7837ce77b0f0df1cea29d

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4bd3158bd62466d57ed72a3f7bc5f205fedd6919

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.