CVE-2026-89656

Received Received - Intake

Buffer Overflow in Linux Kernel CRUSH Map Handling

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crush_decode() stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the decoded bucket id. A malformed map can therefore make one bucket reuse another bucket's workspace by encoding an id different from -1 - slot. For uniform buckets, the second replica selection expands the source bucket's permutation into that aliased workspace buffer. If the source bucket is larger than the aliased bucket, the write runs past the smaller permutation array and can escape the kvmalloc'd CRUSH workspace. KASAN reports a slab OOB write of 4 bytes in bucket_perm_choose(). Reject buckets whose encoded id does not match their array slot. Valid CRUSH maps already use the canonical negative id corresponding to the bucket slot, so this restores the invariant expected by work->work[-1 - in->id] without changing valid map behavior.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89656

EUVD

EUVD-2026-76568

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the CRUSH map handling of the libceph component. A malformed CRUSH map can cause one bucket to reuse another bucket's workspace, leading to a buffer overflow. Specifically, a write operation may exceed the allocated memory space, causing a slab out-of-bounds (OOB) write detected by KASAN.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by triggering a memory corruption issue in the Linux kernel. Systems using the libceph component with Ceph storage may be affected, potentially leading to system crashes or unauthorized access.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the libceph CRUSH id mismatch vulnerability. Monitor kernel logs for slab OOB write errors related to bucket_perm_choose() as an indicator of exploitation.

Hi! I’m here to help you understand CVE-2026-89656. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70