Buffer Overflow Vulnerability in Linux Kernel's Ceph NFS Export - CVE-2026-89652
Summary
DEBIAN-CVE-2026-89652: In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS export get_name ceph_get_name() copies the MDS-supplied name into the caller's NAME_MAX-sized buffer with m... Affects linux versions 6.1.106-1 – 7.2~rc7-1~exp1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management, process control, and system security. The kernel supports various file systems, including Ceph, which is a distributed storage system designed for excellent performance, reliability, and scalability. This vulnerability specifically affects the Ceph file system when it is exported over NFS, potentially allowing attackers to exploit the system through malicious or compromised Ceph Metadata Servers (MDS).
Vulnerability Detail
In the Linux kernel, a vulnerability identified as CVE-2026-89652 has been discovered in the Ceph file system's handling of NFS exports. The issue arises in the ceph_get_name() function, where the length of the name copied from the MDS is not properly checked against the maximum allowed size (NAME_MAX). This oversight can lead to a buffer overflow if an attacker or a compromised MDS returns a name longer than NAME_MAX. The consequences include a slab out-of-bounds write, which can be exploited when a CephFS mount is re-exported over NFS, potentially leading to system crashes or arbitrary code execution.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the NFS export feature of CephFS until the patch is applied. Additionally, ensure that the MDS is not compromised and is configured to return valid name lengths within the NAME_MAX limit.
Conclusion
CVE-2026-89652 represents a significant security risk for systems utilizing the Linux kernel with Ceph file system exports over NFS. Users are strongly advised to update their systems to the latest patched version of the Linux kernel to mitigate this vulnerability. Additionally, monitoring tools like Vulert can assist in identifying potential vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
CVE-2026-89652 is a buffer overflow vulnerability in the Linux kernel's Ceph file system that can be exploited through NFS exports.
If exploited, this vulnerability can lead to system crashes or allow attackers to execute arbitrary code on the affected system.
It is recommended to update your Linux kernel to the patched version as soon as it becomes available and avoid using NFS exports in the meantime.
Yes, you can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software without needing to install any software.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
