CVE-2026-89649
Description
A flaw was found in the Linux kernel's Ceph file system (CephFS) component. A malicious or compromised metadata server can manipulate the length of an extended attribute (xattr) value, causing the system to read beyond the intended memory boundary. This out-of-bounds read allows a local user to access sensitive data from the kernel's memory, leading to information disclosure.
Statement
A kernel heap out-of-bounds read in CephFS xattr decoding can occur because __build_xattrs() validates the encoded value length field but did not verify that the final value bytes remain inside the MDS supplied xattr blob. A malicious or compromised Ceph metadata server can set the last xattr value length larger than the bytes actually present, causing a later getxattr(2) call to copy adjacent kernel heap bytes to a user buffer. For the CVSS the PR:L is used because the disclosure is obtained through a local user context calling getxattr(2) on the affected CephFS mount, while the malformed metadata is supplied by the MDS. The issue is not a direct public Internet attack against an arbitrary host, but it is relevant in environments where CephFS clients trust storage servers or metadata servers reachable over an internal storage network. Impact is confidentiality loss through kernel memory disclosure, with no concrete write primitive or privilege escalation primitive shown by this patch.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.1 | N/A | 9.1 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
