CVE-2026-89656

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89656", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.743Z", "datePublished": "2026-09-11T19:45:45.483Z", "dateUpdated": "2026-10-19T08:50:27.849Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:50:27.849Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: reject buckets with mismatched CRUSH ids\n\ncrush_decode() stores bucket data by array slot, and the mapper later\nderives the per-bucket workspace index from the decoded bucket id. A\nmalformed map can therefore make one bucket reuse another bucket's\nworkspace by encoding an id different from -1 - slot.\n\nFor uniform buckets, the second replica selection expands the source\nbucket's permutation into that aliased workspace buffer. If the source\nbucket is larger than the aliased bucket, the write runs past the smaller\npermutation array and can escape the kvmalloc'd CRUSH workspace. KASAN\nreports a slab OOB write of 4 bytes in bucket_perm_choose().\n\nReject buckets whose encoded id does not match their array slot. Valid\nCRUSH maps already use the canonical negative id corresponding to the\nbucket slot, so this restores the invariant expected by\nwork->work[-1 - in->id] without changing valid map behavior."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - Malformed CRUSH data arrives in CEPH_MSG_OSD_MAP over TCP from a Ceph monitor (mon_dispatch) or OSD (osd_dispatch); crush_decode() stores attacker-chosen bucket ids and crush_do_rule() later indexes the workspace from those ids with no local syscall.\nAC:L - A malicious monitor/OSD fully controls the OSD map and can encode a uniform bucket whose id aliases a smaller bucket's permutation buffer; the second replica expansion in bucket_perm_choose() then deterministically writes past the kvmalloc'd CRUSH workspace without races or rare configs.\nPR:N - The attacker acts as the remote Ceph cluster peer delivering a forged osdmap to an already-connected kernel CephFS/RBD client and needs no local account, capabilities, or user-namespace privileges on the victim host.\nUI:N - Once a kernel Ceph client session exists, osdmap updates are applied automatically and scan_requests/kick_requests call calc_target()/crush_do_rule() without any further mount, open, or other victim interaction at exploit time.\nS:U - The out-of-bounds write corrupts kernel heap on the host running the Ceph client (the CRUSH workspace and adjacent kvmalloc memory), remaining in that kernel security domain rather than crossing a VM, container sandbox, or IOMMU boundary.\nC:H - Aliasing a large uniform bucket onto a smaller permutation array performs an attacker-sized slab out-of-bounds write into adjacent kernel heap, which can be leveraged as a memory-corruption primitive for arbitrary kernel reads and information disclosure.\nI:H - bucket_perm_choose() writes the source bucket's permutation past the aliased workspace into adjacent kvmalloc memory, giving a kernel heap out-of-bounds write that can be used for control-flow hijacking and arbitrary code execution.\nA:H - The slab out-of-bounds write reported by KASAN in bucket_perm_choose() can fault on unmapped adjacent memory or corrupt heap metadata, triggering a kernel oops or panic and complete loss of availability on affected Ceph client hosts."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ceph/osdmap.c"], "versions": [{"version": "66a0e2d579dbec5c676cfe446234ffebb267c564", "lessThan": "ee59040d6ed1a5f8d10d27174b8f32c90ca8e89a", "status": "affected", "versionType": "git"}, {"version": "66a0e2d579dbec5c676cfe446234ffebb267c564", "lessThan": "baad5875fdd2f5e248250fc3519bb045d64f1716", "status": "affected", "versionType": "git"}, {"version": "66a0e2d579dbec5c676cfe446234ffebb267c564", "lessThan": "4aeb93daadf388e72073abc204312dd364eeb30a", "status": "affected", "versionType": "git"}, {"version": "66a0e2d579dbec5c676cfe446234ffebb267c564", "lessThan": "6e5c6ce252b1eccfd41670a5cf95ab44f7ba7022", "status": "affected", "versionType": "git"}, {"version": "66a0e2d579dbec5c676cfe446234ffebb267c564", "lessThan": "3516a4131c4e45d62ee4e42e82c36930e8c1fbbd", "status": "affected", "versionType": "git"}, {"version": "66a0e2d579dbec5c676cfe446234ffebb267c564", "lessThan": "00562ccd4e88d092b9b851df50fad20442bfeb24", "status": "affected", "versionType": "git"}, {"version": "66a0e2d579dbec5c676cfe446234ffebb267c564", "lessThan": "79900d978158b2d80eef952fc41b9e4dc58d7b83", "status": "affected", "versionType": "git"}, {"version": "66a0e2d579dbec5c676cfe446234ffebb267c564", "lessThan": "3cde4a8302301679937474a5f7a851394cc1bd11", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ceph/osdmap.c"], "versions": [{"version": "4.11", "status": "affected"}, {"version": "0", "lessThan": "4.11", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.270", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.221", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.188", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "5.10.270"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "5.15.221"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.1.188"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.6.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ee59040d6ed1a5f8d10d27174b8f32c90ca8e89a"}, {"url": "https://git.kernel.org/stable/c/baad5875fdd2f5e248250fc3519bb045d64f1716"}, {"url": "https://git.kernel.org/stable/c/4aeb93daadf388e72073abc204312dd364eeb30a"}, {"url": "https://git.kernel.org/stable/c/6e5c6ce252b1eccfd41670a5cf95ab44f7ba7022"}, {"url": "https://git.kernel.org/stable/c/3516a4131c4e45d62ee4e42e82c36930e8c1fbbd"}, {"url": "https://git.kernel.org/stable/c/00562ccd4e88d092b9b851df50fad20442bfeb24"}, {"url": "https://git.kernel.org/stable/c/79900d978158b2d80eef952fc41b9e4dc58d7b83"}, {"url": "https://git.kernel.org/stable/c/3cde4a8302301679937474a5f7a851394cc1bd11"}], "title": "libceph: reject buckets with mismatched CRUSH ids", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-89656", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:25:30.231032Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:26:47.436Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-89656", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:25:30.231032Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:25:31.039Z"}}], "cna": {"title": "libceph: reject buckets with mismatched CRUSH ids", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - Malformed CRUSH data arrives in CEPH_MSG_OSD_MAP over TCP from a Ceph monitor (mon_dispatch) or OSD (osd_dispatch); crush_decode() stores attacker-chosen bucket ids and crush_do_rule() later indexes the workspace from those ids with no local syscall.\nAC:L - A malicious monitor/OSD fully controls the OSD map and can encode a uniform bucket whose id aliases a smaller bucket's permutation buffer; the second replica expansion in bucket_perm_choose() then deterministically writes past the kvmalloc'd CRUSH workspace without races or rare configs.\nPR:N - The attacker acts as the remote Ceph cluster peer delivering a forged osdmap to an already-connected kernel CephFS/RBD client and needs no local account, capabilities, or user-namespace privileges on the victim host.\nUI:N - Once a kernel Ceph client session exists, osdmap updates are applied automatically and scan_requests/kick_requests call calc_target()/crush_do_rule() without any further mount, open, or other victim interaction at exploit time.\nS:U - The out-of-bounds write corrupts kernel heap on the host running the Ceph client (the CRUSH workspace and adjacent kvmalloc memory), remaining in that kernel security domain rather than crossing a VM, container sandbox, or IOMMU boundary.\nC:H - Aliasing a large uniform bucket onto a smaller permutation array performs an attacker-sized slab out-of-bounds write into adjacent kernel heap, which can be leveraged as a memory-corruption primitive for arbitrary kernel reads and information disclosure.\nI:H - bucket_perm_choose() writes the source bucket's permutation past the aliased workspace into adjacent kvmalloc memory, giving a kernel heap out-of-bounds write that can be used for control-flow hijacking and arbitrary code execution.\nA:H - The slab out-of-bounds write reported by KASAN in bucket_perm_choose() can fault on unmapped adjacent memory or corrupt heap metadata, triggering a kernel oops or panic and complete loss of availability on affected Ceph client hosts."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "66a0e2d579dbec5c676cfe446234ffebb267c564", "lessThan": "ee59040d6ed1a5f8d10d27174b8f32c90ca8e89a", "versionType": "git"}, {"status": "affected", "version": "66a0e2d579dbec5c676cfe446234ffebb267c564", "lessThan": "baad5875fdd2f5e248250fc3519bb045d64f1716", "versionType": "git"}, {"status": "affected", "version": "66a0e2d579dbec5c676cfe446234ffebb267c564", "lessThan": "4aeb93daadf388e72073abc204312dd364eeb30a", "versionType": "git"}, {"status": "affected", "version": "66a0e2d579dbec5c676cfe446234ffebb267c564", "lessThan": "6e5c6ce252b1eccfd41670a5cf95ab44f7ba7022", "versionType": "git"}, {"status": "affected", "version": "66a0e2d579dbec5c676cfe446234ffebb267c564", "lessThan": "3516a4131c4e45d62ee4e42e82c36930e8c1fbbd", "versionType": "git"}, {"status": "affected", "version": "66a0e2d579dbec5c676cfe446234ffebb267c564", "lessThan": "00562ccd4e88d092b9b851df50fad20442bfeb24", "versionType": "git"}, {"status": "affected", "version": "66a0e2d579dbec5c676cfe446234ffebb267c564", "lessThan": "79900d978158b2d80eef952fc41b9e4dc58d7b83", "versionType": "git"}, {"status": "affected", "version": "66a0e2d579dbec5c676cfe446234ffebb267c564", "lessThan": "3cde4a8302301679937474a5f7a851394cc1bd11", "versionType": "git"}], "programFiles": ["net/ceph/osdmap.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.11"}, {"status": "unaffected", "version": "0", "lessThan": "4.11", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.270", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.221", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.188", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.157", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.109", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.50", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.2.4", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/ceph/osdmap.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ee59040d6ed1a5f8d10d27174b8f32c90ca8e89a"}, {"url": "https://git.kernel.org/stable/c/baad5875fdd2f5e248250fc3519bb045d64f1716"}, {"url": "https://git.kernel.org/stable/c/4aeb93daadf388e72073abc204312dd364eeb30a"}, {"url": "https://git.kernel.org/stable/c/6e5c6ce252b1eccfd41670a5cf95ab44f7ba7022"}, {"url": "https://git.kernel.org/stable/c/3516a4131c4e45d62ee4e42e82c36930e8c1fbbd"}, {"url": "https://git.kernel.org/stable/c/00562ccd4e88d092b9b851df50fad20442bfeb24"}, {"url": "https://git.kernel.org/stable/c/79900d978158b2d80eef952fc41b9e4dc58d7b83"}, {"url": "https://git.kernel.org/stable/c/3cde4a8302301679937474a5f7a851394cc1bd11"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: reject buckets with mismatched CRUSH ids\n\ncrush_decode() stores bucket data by array slot, and the mapper later\nderives the per-bucket workspace index from the decoded bucket id. A\nmalformed map can therefore make one bucket reuse another bucket's\nworkspace by encoding an id different from -1 - slot.\n\nFor uniform buckets, the second replica selection expands the source\nbucket's permutation into that aliased workspace buffer. If the source\nbucket is larger than the aliased bucket, the write runs past the smaller\npermutation array and can escape the kvmalloc'd CRUSH workspace. KASAN\nreports a slab OOB write of 4 bytes in bucket_perm_choose().\n\nReject buckets whose encoded id does not match their array slot. Valid\nCRUSH maps already use the canonical negative id corresponding to the\nbucket slot, so this restores the invariant expected by\nwork->work[-1 - in->id] without changing valid map behavior."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.270", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.221", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.188", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.157", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.109", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.50", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2.4", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.3", "versionStartIncluding": "4.11"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:50:27.849Z"}}}, "cveMetadata": {"cveId": "CVE-2026-89656", "state": "PUBLISHED", "dateUpdated": "2026-10-19T08:50:27.849Z", "dateReserved": "2026-09-11T19:38:34.743Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-09-11T19:45:45.483Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ceph/osdmap.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ee59040d6ed1a5f8d10d27174b8f32c90ca8e89a", "status": "affected", "version": "66a0e2d579dbec5c676cfe446234ffebb267c564", "versionType": "git"}, {"lessThan": "baad5875fdd2f5e248250fc3519bb045d64f1716", "status": "affected", "version": "66a0e2d579dbec5c676cfe446234ffebb267c564", "versionType": "git"}, {"lessThan": "4aeb93daadf388e72073abc204312dd364eeb30a", "status": "affected", "version": "66a0e2d579dbec5c676cfe446234ffebb267c564", "versionType": "git"}, {"lessThan": "6e5c6ce252b1eccfd41670a5cf95ab44f7ba7022", "status": "affected", "version": "66a0e2d579dbec5c676cfe446234ffebb267c564", "versionType": "git"}, {"lessThan": "3516a4131c4e45d62ee4e42e82c36930e8c1fbbd", "status": "affected", "version": "66a0e2d579dbec5c676cfe446234ffebb267c564", "versionType": "git"}, {"lessThan": "00562ccd4e88d092b9b851df50fad20442bfeb24", "status": "affected", "version": "66a0e2d579dbec5c676cfe446234ffebb267c564", "versionType": "git"}, {"lessThan": "79900d978158b2d80eef952fc41b9e4dc58d7b83", "status": "affected", "version": "66a0e2d579dbec5c676cfe446234ffebb267c564", "versionType": "git"}, {"lessThan": "3cde4a8302301679937474a5f7a851394cc1bd11", "status": "affected", "version": "66a0e2d579dbec5c676cfe446234ffebb267c564", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ceph/osdmap.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.11"}, {"lessThan": "4.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.270", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.221", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.188", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.157", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: reject buckets with mismatched CRUSH ids\n\ncrush_decode() stores bucket data by array slot, and the mapper later\nderives the per-bucket workspace index from the decoded bucket id. A\nmalformed map can therefore make one bucket reuse another bucket's\nworkspace by encoding an id different from -1 - slot.\n\nFor uniform buckets, the second replica selection expands the source\nbucket's permutation into that aliased workspace buffer. If the source\nbucket is larger than the aliased bucket, the write runs past the smaller\npermutation array and can escape the kvmalloc'd CRUSH workspace. KASAN\nreports a slab OOB write of 4 bytes in bucket_perm_choose().\n\nReject buckets whose encoded id does not match their array slot. Valid\nCRUSH maps already use the canonical negative id corresponding to the\nbucket slot, so this restores the invariant expected by\nwork->work[-1 - in->id] without changing valid map behavior."}], "id": "CVE-2026-89656", "lastModified": "2026-10-19T09:18:03.343", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-89656", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:25:30.231032Z", "version": "2.0.3"}}]}, "published": "2026-09-11T20:19:51.813", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/00562ccd4e88d092b9b851df50fad20442bfeb24"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3516a4131c4e45d62ee4e42e82c36930e8c1fbbd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3cde4a8302301679937474a5f7a851394cc1bd11"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4aeb93daadf388e72073abc204312dd364eeb30a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6e5c6ce252b1eccfd41670a5cf95ab44f7ba7022"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/79900d978158b2d80eef952fc41b9e4dc58d7b83"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/baad5875fdd2f5e248250fc3519bb045d64f1716"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ee59040d6ed1a5f8d10d27174b8f32c90ca8e89a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: libceph memory corruption via malformed CRUSH map", "id": "2532365", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532365"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in libceph within the Linux kernel. This vulnerability allows a local attacker to craft a malformed CRUSH map, which is used for data placement. By doing so, one data bucket can be made to reuse another bucket's memory workspace, leading to an out-of-bounds write. This memory corruption could result in a denial of service or potentially lead to privilege escalation."], "name": "CVE-2026-89656", "public_date": "2026-09-11T19:45:45Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89656\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89656\nhttps://git.kernel.org/stable/c/00562ccd4e88d092b9b851df50fad20442bfeb24\nhttps://git.kernel.org/stable/c/3516a4131c4e45d62ee4e42e82c36930e8c1fbbd\nhttps://git.kernel.org/stable/c/3cde4a8302301679937474a5f7a851394cc1bd11\nhttps://git.kernel.org/stable/c/79900d978158b2d80eef952fc41b9e4dc58d7b83"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[66a0e2d579dbec5c676cfe446234ffebb267c564,3516a4131c4e45d62ee4e42e82c36930e8c1fbbd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[66a0e2d579dbec5c676cfe446234ffebb267c564,00562ccd4e88d092b9b851df50fad20442bfeb24)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[66a0e2d579dbec5c676cfe446234ffebb267c564,79900d978158b2d80eef952fc41b9e4dc58d7b83)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[66a0e2d579dbec5c676cfe446234ffebb267c564,3cde4a8302301679937474a5f7a851394cc1bd11)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.109,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.50,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.4,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-12T07:30:10.434881+00:00", "updated": "2026-09-15T21:30:16.425050+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}