The Linux kernel's Ceph filesystem had a vulnerability (CVE-2026-89652) where the function ceph_get_name() copied a dentry name from the MDS into a fixed-size buffer without verifying that the name length did not exceed NAME_MAX. This unchecked copy could lead to a slab out-of-bounds write, as confirmed by KASAN reports. The flaw is exploitable when a CephFS mount is re-exported over NFS and a malicious or compromised MDS returns a LOOKUPNAME reply with an excessively long name length. The fix introduced ceph_export_copy_name(), which enforces a length check and returns an error if the name is too long, preventing the overflow.

A malicious or compromised Ceph Metadata Server can trigger a buffer overflow in the client's kernel memory by sending a name length exceeding the allowed maximum during NFS export get_name operations. This results in an out-of-bounds write in kernel memory, which could potentially lead to system instability or denial of service. There is no indication of known exploits in the wild.

The vulnerability has been resolved by adding a length check function (ceph_export_copy_name()) that rejects names longer than NAME_MAX before copying. Users should apply the official Linux kernel patch that includes this fix. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended remediation. No additional mitigation steps are indicated.