CVE-2026-89648: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-89648 is a denial-of-service vulnerability in the Linux kernel's Ceph filesystem subsystem, specifically in the ceph_parse_deleg_inos() function. The function fails to validate the length of delegated inode intervals received from a Ceph MDS (Metadata Server) create-with-delegation reply, allowing a malicious or compromised MDS to trigger unbounded memory consumption or infinite loops on connected clients. The vulnerability affects Linux kernel versions from 5.7 onward, with fixes available in 6.18.51, 7.2.4, and 7.3-rc1. It is classified as Medium severity (CWE-606: Unchecked Input for Loop Condition) (Red Hat Advisory, Feedly).

The root cause is CWE-606 (Unchecked Input for Loop Condition): ceph_parse_deleg_inos() decodes 64-bit start and len values from MDS replies using ceph_decode_64_safe(), which only validates that eight bytes are present in the message — not the value of len itself. The function then loops over len while inserting entries into an xarray (s_delegated_inos) without any upper bound, meaning an attacker-controlled len can cause the loop to spin indefinitely or grow the xarray without limit. Attack vectors include sending one huge interval, many intervals in a single reply, duplicate intervals, or repeated replies that accumulate delegated inodes on the same session. The fix introduces an atomic counter per MDS session, enforced at ceph_insert_deleg_ino() using atomic_add_unless() to cap the total at CEPH_MAX_DELEG_INOS (Red Hat Advisory).

A malicious or compromised Ceph MDS server can send crafted create-with-delegation replies that cause the Linux kernel's Ceph client to enter infinite loops or consume unbounded kernel memory, resulting in a denial of service on affected client systems. The impact is limited to availability — there is no evidence of confidentiality or integrity compromise. Systems running Ceph-mounted filesystems on Linux kernel 5.7 and later are at risk if they connect to an untrusted or compromised MDS (Red Hat Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The vulnerability requires the attacker to control or compromise a Ceph MDS server that clients connect to, making opportunistic exploitation unlikely without prior access to the MDS infrastructure. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and no EPSS score data is currently available (Red Hat Advisory, Feedly).

1. Gain MDS control: Compromise or operate a Ceph MDS server that target Linux clients are configured to connect to.
2. Craft malicious reply: Prepare a create-with-delegation MDS reply containing one or more delegated inode intervals with an extremely large 64-bit len value (e.g., 0xFFFFFFFFFFFFFFFF) or a very large number of intervals.
3. Trigger client processing: Cause a client to initiate a file create operation that elicits the crafted delegation reply from the MDS.
4. Induce DoS: The client kernel's ceph_parse_deleg_inos() enters an unbounded loop or allocates unbounded xarray memory, exhausting CPU or kernel memory and causing a denial of service on the client (Red Hat Advisory).

• Logs: Kernel logs (dmesg) showing repeated or hung Ceph-related operations, memory allocation failures (ENOMEM), or soft lockup warnings associated with the Ceph subsystem.
• System Behavior: Sudden spike in kernel memory usage or CPU utilization on systems with Ceph mounts, particularly during file create operations.
• Network: Unusual or repeated MDS create-with-delegation reply messages from an MDS server, observable via packet capture on the Ceph network interface.

Apply a Linux kernel update containing the fix: version 6.18.51 or later in the 6.18 series, 7.2.4 or later in the 7.2 series, or any 7.3-rc1 or later release. The patch introduces per-session atomic counting of delegated inodes capped at CEPH_MAX_DELEG_INOS, enforced at ceph_insert_deleg_ino(). As an interim workaround, restrict network access so that Ceph clients only connect to trusted, verified MDS servers, reducing the attack surface to insider or supply-chain threats (Red Hat Advisory, Red Hat Bugzilla).