CVE-2026-89651

In the Linux kernel, the following vulnerability has been resolved:

ceph: bound MDSCapAuth path and fs_name decode in handle_session()

handle_session() decodes the MDSCapAuth records carried by a

CEPH_SESSION_OPEN message (msg_version >= 6). For each record the

match.path and match.fs_name byte strings are read by first decoding a

32-bit length and then copying that many bytes with the bare

ceph_decode_copy(). Unlike the surrounding fields, which all use the

_safe decode variants, these two copies are not preceded by a

ceph_decode_need() bounds check, and the enclosing MDSCapAuth and

MDSCapMatch struct_len fields are skipped rather than enforced as an

upper bound. A length larger than the bytes remaining in the message

front makes ceph_decode_copy() read past the end of the front buffer.

The message front is a dedicated allocation (ceph_msg_new2() ->

kvmalloc), so the over-read runs off that object. A malicious or

compromised MDS can trigger this with the first post-connect message on

mount, with no client-side user interaction; under KASAN it is reported

as a slab-out-of-bounds read in handle_session().

Impact: a malicious MDS can force the kernel client to read up to 4 GiB

past the message front allocation during session setup, crashing the

client (out-of-bounds read).

Switch both copies to ceph_decode_copy_safe(), which performs the

ceph_decode_need() bounds check before the copy and branches to the

existing bad label, matching the rest of the decoder and the error path

that frees the partially decoded cap_auths array.