CVE-2026-89652

Received Received - Intake

Buffer Overflow in Ceph NFS Export Name Handling

Publication date: 2026-09-11

Last updated on: 2026-09-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS export get_name ceph_get_name() copies the MDS-supplied name into the caller's NAME_MAX-sized buffer with memcpy(name, rinfo->dname, rinfo->dname_len) and then writes name[rinfo->dname_len] = 0, without checking dname_len against NAME_MAX. A malicious or buggy MDS that returns a LOOKUPNAME reply with dname_len > NAME_MAX overflows the buffer. __get_snap_name() copies rde->name / rde->name_len the same unchecked way. Impact: a malicious or compromised Ceph MDS overflows the NAME_MAX name buffer in a client's NFS-export get_name path, a slab out-of-bounds write reported by KASAN. Reachable when a CephFS mount is re-exported over NFS. Add ceph_export_copy_name(), which rejects lengths above NAME_MAX with -ENAMETOOLONG before the copy, and use it in both ceph_get_name() and __get_snap_name().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-14

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-89652

EUVD

EUVD-2026-76564

Affected Vendors & Products

Vendor	Product	Version / Range
ceph	ceph	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a buffer overflow issue in the Linux kernel's Ceph NFS export functionality. It occurs when the Ceph Metadata Server (MDS) returns a name length exceeding NAME_MAX during a lookup operation. The kernel copies this name into a fixed-size buffer without checking the length, leading to a slab out-of-bounds write that KASAN can detect.

Detection Guidance

This vulnerability is specific to the Linux kernel's Ceph NFS export functionality. Detection requires checking if your system uses a vulnerable kernel version with Ceph NFS exports enabled. Examine kernel logs for slab out-of-bounds write errors reported by KASAN. Check if your Ceph MDS is returning dentry names exceeding NAME_MAX length.

Impact Analysis

If you are using CephFS mounted and re-exported over NFS, a malicious or compromised MDS could exploit this flaw to cause a kernel memory corruption. This may lead to system crashes, privilege escalation, or potential code execution on the affected system.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves a buffer overflow in the Linux kernel's Ceph NFS export functionality. However, if exploited, it could lead to unauthorized data access or system compromise, which may indirectly impact compliance by violating data integrity or confidentiality requirements.

Mitigation Strategies

Apply the kernel patch that adds bounds checking in ceph_export_copy_name(). Disable NFS re-export of CephFS mounts until patched. Monitor MDS logs for abnormal dentry name lengths. Update to a kernel version containing the fix if available.

Hi! I’m here to help you understand CVE-2026-89652. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70