CVE-2026-89648

A Ceph client can consume unbounded CPU time or memory while parsing delegated inode intervals from an MDS create with delegation reply. The vulnerable path trusts the 64 bit len value after only checking that the bytes are present, then loops over len and inserts entries into the per session delegated inode xarray. A malicious or compromised MDS can send a huge interval, many intervals, duplicate ranges, or repeated replies to make the client spin or grow the xarray without a bound. For the CVSS the PR:N is used because no privileges are required on the victim client once the attacker can control or impersonate the MDS endpoint. The issue is network reachable through Ceph MDS protocol traffic, although Ceph MDS services are usually deployed on trusted storage or data center networks rather than the public Internet. Impact is denial of service through CPU exhaustion or memory exhaustion. No confidentiality or integrity impact is assigned because the patch supports a resource exhaustion class rather than a memory corruption primitive.