CVE-2026-89652 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel and Ceph deployments, particularly those using NFS exports, should assess exposure and prioritize patching to mitigate this vulnerability. This includes system administrators, security teams, and IT professionals managing CephFS and NFS environments. They should review configurations, apply patches, and monitor for potential exploitation attempts to protect against this vulnerability.

Why it matters

A critical vulnerability in the Linux kernel's Ceph implementation allows a malicious or compromised Ceph MDS to overflow a buffer in a client's NFS-export get_name path. Defenders should prioritize verifying and applying patches, particularly in environments where CephFS is re-exported over NFS.

• Potential buffer overflow and slab out-of-bounds write in the NFS export get_name path.
• Possible exploitation by a malicious or compromised Ceph MDS.
• Requires verification of affected versions and application of patches.
• May impact CephFS mounts re-exported over NFS.

Technical summary

The Linux kernel's Ceph implementation did not properly bound the copied dentry name length in the NFS export get_name path. A malicious or compromised Ceph MDS could supply a LOOKUPNAME reply with dname_len > NAME_MAX, causing a buffer overflow and slab out-of-bounds write when processed by the client. This issue is exploitable when a CephFS mount is re-exported over NFS. The fix involves adding a new function, ceph_export_copy_name(), which rejects lengths above NAME_MAX with -ENAMETOOLONG before copying the name, thus preventing the buffer overflow. This change ensures that the kernel's Ceph implementation properly handles dentry name lengths, preventing potential exploitation.

Defensive priority

Defenders should prioritize verifying and applying patches to mitigate this vulnerability, particularly in environments where CephFS is re-exported over NFS.

Recommended defensive actions

• Verify and apply patches to the Linux kernel to fix the vulnerability.
• Review and update CephFS and NFS export configurations to ensure secure deployment.
• Monitor for potential exploitation attempts in environments where CephFS is re-exported over NFS.
• Perform a thorough review of affected systems and assess potential exposure.
• Inventory CephFS and NFS export configurations to identify areas of potential risk.
• Consider implementing compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was resolved by adding a new function, ceph_export_copy_name(), which rejects lengths above NAME_MAX with -ENAMETOOLONG before copying the name. This fix was applied in multiple commits.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.