In the Linux kernel, the following vulnerability has been resolved: ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode MDSMap… (CVE-2026-89653)
A vulnerability in the Linux kernel's Ceph component related to MDSMap decoding has been resolved. The issue involved the handling of export_targets ranks that are greater than or equal to CEPH_MAX_MDS, which could cause out-of-bounds writes in a fixed stack bitmap. The fix rejects ranks outside the CEPH_MAX_MDS range during map decoding to prevent this issue.
AI Analysis
Technical Summary
The vulnerability in the Linux kernel's Ceph subsystem concerns the decoding of MDSMap export_targets entries. These entries are controlled by the monitor and are used as bit numbers in a fixed stack bitmap via set_bit(). If a rank outside the protocol namespace (i.e., ranks >= CEPH_MAX_MDS) is used, set_bit() could write past the end of the array, leading to memory corruption. The resolution involves rejecting ranks outside CEPH_MAX_MDS during map decoding, while not validating against possible_max_rank since maps may reference ranks beyond a temporarily reduced max_mds.
Potential Impact
The vulnerability could lead to out-of-bounds memory writes during MDSMap decoding in the Ceph filesystem, potentially causing memory corruption. The exact impact is not detailed in the input data, and no known exploits in the wild are reported.
Mitigation Recommendations
A fix has been applied to reject export_targets ranks greater than or equal to CEPH_MAX_MDS during MDSMap decoding. Users should update to the patched Linux kernel version that includes this fix. No additional mitigation steps are indicated.
In the Linux kernel, the following vulnerability has been resolved: ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode MDSMap… (CVE-2026-89653)
Description
A vulnerability in the Linux kernel's Ceph component related to MDSMap decoding has been resolved. The issue involved the handling of export_targets ranks that are greater than or equal to CEPH_MAX_MDS, which could cause out-of-bounds writes in a fixed stack bitmap. The fix rejects ranks outside the CEPH_MAX_MDS range during map decoding to prevent this issue.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel's Ceph subsystem concerns the decoding of MDSMap export_targets entries. These entries are controlled by the monitor and are used as bit numbers in a fixed stack bitmap via set_bit(). If a rank outside the protocol namespace (i.e., ranks >= CEPH_MAX_MDS) is used, set_bit() could write past the end of the array, leading to memory corruption. The resolution involves rejecting ranks outside CEPH_MAX_MDS during map decoding, while not validating against possible_max_rank since maps may reference ranks beyond a temporarily reduced max_mds.
Potential Impact
The vulnerability could lead to out-of-bounds memory writes during MDSMap decoding in the Ceph filesystem, potentially causing memory corruption. The exact impact is not detailed in the input data, and no known exploits in the wild are reported.
Mitigation Recommendations
A fix has been applied to reject export_targets ranks greater than or equal to CEPH_MAX_MDS during MDSMap decoding. Users should update to the patched Linux kernel version that includes this fix. No additional mitigation steps are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-q4wh-f6ch-5m9w
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-89653"]
Threat ID: 6aa4a00355bf5e2cf5a86623
Added to database: 09/12/2026, 00:42:43 UTC
Last enriched: 09/12/2026, 00:56:45 UTC
Last updated: 09/12/2026, 00:56:45 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.