CVE
DEBIAN-CVE-2026-89653
In the Linux kernel, the following vulnerability has been resolved: ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode MDSMap export_targets entries are monitor controlled.
In the Linux kernel, the following vulnerability has been resolved: ceph: reject exporttargets ranks >= CEPHMAXMDS in mdsmap decode MDSMap exporttargets entries are monitor controlled. checknewmap() uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can make setbit() write past the end of the array. Reject ranks outside CEPHMAXMDS while decoding the map. Do not validate against possiblemaxrank here because maps may legitimately reference ranks beyond a temporarily reduced maxmds.
Package Versions Affected
Package Version
patch Availability
No items found.
Automatically patch vulnerabilities without upgrading
Fix Without Upgrading
Detect compatible fix
Apply safe remediation
Fix with a single pull request
CVSS Version
Severity
Base Score
CVSS Version
Score Vector
C
H
U
-
C
H
U
0
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
C
H
U
-
Related Resources
No items found.
References
https://security-tracker.debian.org/tracker/CVE-2026-89653