CVE-2026-90067 addresses a flaw in the Linux kernel's libceph module where the Ceph messenger v2 protocol banner's payload length field was not properly validated. A payload length of zero leads to a zero-length socket read, violating kernel state machine invariants and causing warnings in populate_in_iter(). The protocol specification requires the payload to be at least 16 bytes to include two 64-bit integers. The vulnerability is fixed by adding a check in process_banner_prefix() to reject payload lengths smaller than 16 bytes, thus preventing the invalid state and aborting the connection with a protocol error.

This vulnerability can cause a denial of service condition by triggering kernel warnings and potentially destabilizing the kernel due to violation of internal state machine invariants. There is no indication of confidentiality or integrity impact. The CVSS score is 7.5 (high) with an attack vector of network, no privileges required, and no user interaction needed.

A fix is available that validates the banner payload length in the Ceph messenger v2 protocol to ensure it is at least 16 bytes. Systems should apply the official Linux kernel update that includes this patch. No additional mitigations are indicated or required beyond applying the fix.