GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89650 (GCVE-0-2026-89650)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:45 – Updated: 2026-09-14 12:01
VLAI
Title
ceph: bound num_export_targets array for mds info v2/v3
Summary
In the Linux kernel, the following vulnerability has been resolved: ceph: bound num_export_targets array for mds info v2/v3 ceph_mdsmap_decode() in fs/ceph/mdsmap.c reads num_export_targets from each per-mds info record and advances the decode cursor by num_export_targets * sizeof(u32) without first checking that many bytes remain. The only upper-bound check that catches a runaway cursor (*p > info_end) is gated on info_v >= 4, because info_end is left NULL for info_v 2 and 3. When the monitor sends an MDS map whose per-mds info version is 2 or 3 with an oversized num_export_targets, the cursor moves past the message front buffer and the later export-targets loop calls the unchecked ceph_decode_32() on out-of-bounds memory. A kernel client processes CEPH_MSG_MDS_MAP from its monitor session (net/ceph/mon_client.c dispatches it; fs/ceph/super.c routes it to ceph_mdsc_handle_mdsmap(), which sets end to the front buffer bound and calls ceph_mdsmap_decode()). A malicious or compromised monitor, or an on-path attacker on an unsigned/unencrypted messenger session, can therefore drive an out-of-bounds read in the client kernel; on x86_64 with KASAN it is reported as a slab-out-of-bounds read in ceph_mdsmap_decode(). The decoded values land in the internal info->export_targets[] array, so the consequence is a kernel out-of-bounds read, not an information leak to the attacker. Impact: a malicious or compromised Ceph monitor sending an MDS map with a per-mds info version of 2 or 3 and an oversized num_export_targets field triggers an out-of-bounds read in the CephFS client kernel. Add a ceph_decode_need() for the export-targets array before advancing the cursor, so the bound is enforced for every info_v >= 2, not only info_v >= 4. This mirrors the count-then-need idiom already used for m_data_pg_pools later in the same function. Compute the export-targets byte count with size_mul() and reuse that checked length when advancing the cursor, so the attacker-controlled num_export_targets multiplication fails closed on overflow rather than relying on the later kcalloc() guard.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d463a43d69f4af85887671d76182437775fd1631 , < 0c4bcc3ba7291d383b82ce1c2fe324f69a42da2d (git)
Affected: d463a43d69f4af85887671d76182437775fd1631 , < 55a06b32438c222765138727d0a8164b103e8f0d (git)
Affected: d463a43d69f4af85887671d76182437775fd1631 , < eb3e1a1cb1634c76d59c5a9cb1a026fc69d40911 (git)
Affected: d463a43d69f4af85887671d76182437775fd1631 , < 3bf7dba8dba9a05774b846affec61a3624ddba38 (git)
Affected: d463a43d69f4af85887671d76182437775fd1631 , < 58c2d3e954c13694ef6e820a5e9456461bb9e7df (git)
Affected: d463a43d69f4af85887671d76182437775fd1631 , < 332c444f4dc6fa1e8b8637c9e82d29e97f768656 (git)
Affected: d463a43d69f4af85887671d76182437775fd1631 , < a3eb169ee297aa99670ba927c659990bd1e453f3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.7
Unaffected: 0 , < 4.7 (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/mdsmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0c4bcc3ba7291d383b82ce1c2fe324f69a42da2d",
              "status": "affected",
              "version": "d463a43d69f4af85887671d76182437775fd1631",
              "versionType": "git"
            },
            {
              "lessThan": "55a06b32438c222765138727d0a8164b103e8f0d",
              "status": "affected",
              "version": "d463a43d69f4af85887671d76182437775fd1631",
              "versionType": "git"
            },
            {
              "lessThan": "eb3e1a1cb1634c76d59c5a9cb1a026fc69d40911",
              "status": "affected",
              "version": "d463a43d69f4af85887671d76182437775fd1631",
              "versionType": "git"
            },
            {
              "lessThan": "3bf7dba8dba9a05774b846affec61a3624ddba38",
              "status": "affected",
              "version": "d463a43d69f4af85887671d76182437775fd1631",
              "versionType": "git"
            },
            {
              "lessThan": "58c2d3e954c13694ef6e820a5e9456461bb9e7df",
              "status": "affected",
              "version": "d463a43d69f4af85887671d76182437775fd1631",
              "versionType": "git"
            },
            {
              "lessThan": "332c444f4dc6fa1e8b8637c9e82d29e97f768656",
              "status": "affected",
              "version": "d463a43d69f4af85887671d76182437775fd1631",
              "versionType": "git"
            },
            {
              "lessThan": "a3eb169ee297aa99670ba927c659990bd1e453f3",
              "status": "affected",
              "version": "d463a43d69f4af85887671d76182437775fd1631",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/mdsmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: bound num_export_targets array for mds info v2/v3\n\nceph_mdsmap_decode() in fs/ceph/mdsmap.c reads num_export_targets from\neach per-mds info record and advances the decode cursor by\nnum_export_targets * sizeof(u32) without first checking that many bytes\nremain. The only upper-bound check that catches a runaway cursor\n(*p \u003e info_end) is gated on info_v \u003e= 4, because info_end is left NULL\nfor info_v 2 and 3. When the monitor sends an MDS map whose per-mds\ninfo version is 2 or 3 with an oversized num_export_targets, the cursor\nmoves past the message front buffer and the later export-targets loop\ncalls the unchecked ceph_decode_32() on out-of-bounds memory.\n\nA kernel client processes CEPH_MSG_MDS_MAP from its monitor session\n(net/ceph/mon_client.c dispatches it; fs/ceph/super.c routes it to\nceph_mdsc_handle_mdsmap(), which sets end to the front buffer bound and\ncalls ceph_mdsmap_decode()). A malicious or compromised monitor, or an\non-path attacker on an unsigned/unencrypted messenger session, can\ntherefore drive an out-of-bounds read in the client kernel; on x86_64\nwith KASAN it is reported as a slab-out-of-bounds read in\nceph_mdsmap_decode(). The decoded values land in the internal\ninfo-\u003eexport_targets[] array, so the consequence is a kernel\nout-of-bounds read, not an information leak to the attacker.\n\nImpact: a malicious or compromised Ceph monitor sending an MDS map with\na per-mds info version of 2 or 3 and an oversized num_export_targets\nfield triggers an out-of-bounds read in the CephFS client kernel.\n\nAdd a ceph_decode_need() for the export-targets array before advancing\nthe cursor, so the bound is enforced for every info_v \u003e= 2, not only\ninfo_v \u003e= 4. This mirrors the count-then-need idiom already used for\nm_data_pg_pools later in the same function.\n\nCompute the export-targets byte count with size_mul() and reuse that\nchecked length when advancing the cursor, so the attacker-controlled\nnum_export_targets multiplication fails closed on overflow rather than\nrelying on the later kcalloc() guard."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - CEPH_MSG_MDS_MAP arrives over the kernel Ceph messenger TCP session from a monitor (mon_dispatch/extra_mon_dispatch) or MDS (mds_dispatch) and is decoded in ceph_mdsmap_decode(); a malicious cluster peer or on-path attacker on an unsigned msgr session reaches the bug with network data alone.\nAC:L - The attacker fully controls per-mds info_v and num_export_targets; setting info_v to 2 or 3 (so info_end stays NULL) and an oversized count deterministically advances the cursor past msg-\u003efront and hits unchecked ceph_decode_32(), with no race or victim memory layout required.\nPR:N - The attacker acts as the remote Ceph monitor or MDS peer (or MITM on msgr1/crc or auth_none); no local account, capability, or privilege on the victim CephFS client host is required.\nUI:N - Once CephFS is mounted, the kernel client subscribes to MDS maps and ceph_mdsc_handle_mdsmap() runs automatically on each update; no further mount, open, or interactive victim action is required at exploit time.\nS:U - The out-of-bounds read, any leaked heap bytes, and a possible oops stay inside the victim host kernel CephFS client and do not cross a VM, container, IOMMU, or other security authority.\nC:H - An attacker-chosen num_export_targets drives an unbounded loop of unchecked ceph_decode_32() reads past the message front slab into adjacent kernel heap (KASAN slab-out-of-bounds); per kernel guidance an unbounded out-of-bounds read is Confidentiality High.\nI:N - OOB words are copied only into a correctly sized kcalloc\u0027d export_targets array; overshooting the front buffer then fails later ceph_decode_32_safe() so the map is destroyed and never installed, giving no out-of-bounds write or control-flow primitive.\nA:H - Walking an attacker-chosen number of u32s past the kmalloc\u0027d msg-\u003efront object into unmapped or guarded pages oopses the ceph-msgr worker, and a failed decode also shuts down the mount via ceph_umount_begin(); both are repeatable on each crafted map."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:01:46.012Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0c4bcc3ba7291d383b82ce1c2fe324f69a42da2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/55a06b32438c222765138727d0a8164b103e8f0d"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb3e1a1cb1634c76d59c5a9cb1a026fc69d40911"
        },
        {
          "url": "https://git.kernel.org/stable/c/3bf7dba8dba9a05774b846affec61a3624ddba38"
        },
        {
          "url": "https://git.kernel.org/stable/c/58c2d3e954c13694ef6e820a5e9456461bb9e7df"
        },
        {
          "url": "https://git.kernel.org/stable/c/332c444f4dc6fa1e8b8637c9e82d29e97f768656"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3eb169ee297aa99670ba927c659990bd1e453f3"
        }
      ],
      "title": "ceph: bound num_export_targets array for mds info v2/v3",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89650",
    "datePublished": "2026-09-11T19:45:40.867Z",
    "dateReserved": "2026-09-11T19:38:34.742Z",
    "dateUpdated": "2026-09-14T12:01:46.012Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89650",
      "date": "2026-09-17",
      "epss": "0.00509",
      "percentile": "0.42256"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-14T15:02:51.000Z",
      "cve": "CVE-2026-89650",
      "id": "msrc_CVE-2026-89650",
      "initial_release_date": "2026-09-13T01:01:33.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ceph: bound num_export_targets array for mds info v2/v3",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89650.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89650\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:51.023\",\"lastModified\":\"2026-09-14T13:19:17.400\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nceph: bound num_export_targets array for mds info v2/v3\\n\\nceph_mdsmap_decode() in fs/ceph/mdsmap.c reads num_export_targets from\\neach per-mds info record and advances the decode cursor by\\nnum_export_targets * sizeof(u32) without first checking that many bytes\\nremain. The only upper-bound check that catches a runaway cursor\\n(*p \u003e info_end) is gated on info_v \u003e= 4, because info_end is left NULL\\nfor info_v 2 and 3. When the monitor sends an MDS map whose per-mds\\ninfo version is 2 or 3 with an oversized num_export_targets, the cursor\\nmoves past the message front buffer and the later export-targets loop\\ncalls the unchecked ceph_decode_32() on out-of-bounds memory.\\n\\nA kernel client processes CEPH_MSG_MDS_MAP from its monitor session\\n(net/ceph/mon_client.c dispatches it; fs/ceph/super.c routes it to\\nceph_mdsc_handle_mdsmap(), which sets end to the front buffer bound and\\ncalls ceph_mdsmap_decode()). A malicious or compromised monitor, or an\\non-path attacker on an unsigned/unencrypted messenger session, can\\ntherefore drive an out-of-bounds read in the client kernel; on x86_64\\nwith KASAN it is reported as a slab-out-of-bounds read in\\nceph_mdsmap_decode(). The decoded values land in the internal\\ninfo-\u003eexport_targets[] array, so the consequence is a kernel\\nout-of-bounds read, not an information leak to the attacker.\\n\\nImpact: a malicious or compromised Ceph monitor sending an MDS map with\\na per-mds info version of 2 or 3 and an oversized num_export_targets\\nfield triggers an out-of-bounds read in the CephFS client kernel.\\n\\nAdd a ceph_decode_need() for the export-targets array before advancing\\nthe cursor, so the bound is enforced for every info_v \u003e= 2, not only\\ninfo_v \u003e= 4. This mirrors the count-then-need idiom already used for\\nm_data_pg_pools later in the same function.\\n\\nCompute the export-targets byte count with size_mul() and reuse that\\nchecked length when advancing the cursor, so the attacker-controlled\\nnum_export_targets multiplication fails closed on overflow rather than\\nrelying on the later kcalloc() guard.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ceph/mdsmap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d463a43d69f4af85887671d76182437775fd1631\",\"lessThan\":\"0c4bcc3ba7291d383b82ce1c2fe324f69a42da2d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d463a43d69f4af85887671d76182437775fd1631\",\"lessThan\":\"55a06b32438c222765138727d0a8164b103e8f0d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d463a43d69f4af85887671d76182437775fd1631\",\"lessThan\":\"eb3e1a1cb1634c76d59c5a9cb1a026fc69d40911\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d463a43d69f4af85887671d76182437775fd1631\",\"lessThan\":\"3bf7dba8dba9a05774b846affec61a3624ddba38\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d463a43d69f4af85887671d76182437775fd1631\",\"lessThan\":\"58c2d3e954c13694ef6e820a5e9456461bb9e7df\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d463a43d69f4af85887671d76182437775fd1631\",\"lessThan\":\"332c444f4dc6fa1e8b8637c9e82d29e97f768656\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d463a43d69f4af85887671d76182437775fd1631\",\"lessThan\":\"a3eb169ee297aa99670ba927c659990bd1e453f3\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ceph/mdsmap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0c4bcc3ba7291d383b82ce1c2fe324f69a42da2d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/332c444f4dc6fa1e8b8637c9e82d29e97f768656\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3bf7dba8dba9a05774b846affec61a3624ddba38\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/55a06b32438c222765138727d0a8164b103e8f0d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/58c2d3e954c13694ef6e820a5e9456461bb9e7df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a3eb169ee297aa99670ba927c659990bd1e453f3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/eb3e1a1cb1634c76d59c5a9cb1a026fc69d40911\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T07:00:03+00:00",
      "cve": "CVE-2026-89650",
      "id": "CVE-2026-89650",
      "initial_release_date": "2026-09-11T19:45:40.867000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel (Ceph): Out-of-bounds read in client via crafted MDS map",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89650.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-16T00:01:10Z",
      "cve": "CVE-2026-89650",
      "id": "CVE-2026-89650",
      "initial_release_date": "2026-09-16T00:01:10Z",
      "product_status:known_affected": "347",
      "product_status:known_not_affected": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89650",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89650.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.