# CVE-2026-89657

## Summary

- **CVE ID:** CVE-2026-89657
- **Severity:** HIGH
- **CVSS Score:** 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- **CWE:** N/A
- **Published:** Sep 11, 2026
- **Last Modified:** Sep 14, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:

libceph: validate OSD extent maps before cursor advance

net/ceph/osd_client.c:osd_sparse_read() validates that the sparse-read
data length matches the summed extent lengths, but it does not validate
that each OSD-supplied extent is monotonic and lies inside the original
request range. A malformed authenticated OSD reply can advertise a
far-forward nonzero extent offset with a matching data length and make
the client advance the message-data cursor beyond the request buffer.
This reaches the BUG_ON(!*length) assertion in ceph_msg_data_next() from
the client receive path.

Impact: A malicious or compromised authenticated Ceph OSD peer can crash
a kernel Ceph client via a malformed sparse-read reply.

Reject sparse extent maps that overflow, move backwards, overlap, or
extend outside the original sparse-read request before advancing the
cursor.

[ idryomov: perform sparse_extent_map_valid() check a bit earlier,
  in CEPH_SPARSE_READ_DATA_LEN instead of CEPH_SPARSE_READ_DATA_PRE
  state ]

## Affected Products

- Linux — Linux (f628d799972799023d32c2542bb2639eb8c4f84e)
- Linux — Linux (6.6)
- Linux — Linux (0)
- Linux — Linux (6.12.109)
- Linux — Linux (6.18.50)
- Linux — Linux (7.2.4)
- Linux — Linux (7.3-rc1)
- Linux — Linux (6.6.157)

## References

- [CNA](https://git.kernel.org/stable/c/058ffa81f9440c5b4714685611cf697fd3739ec9)
- [CNA](https://git.kernel.org/stable/c/2571b35883268a266554e80d368e67fdfea7fb9d)
- [CNA](https://git.kernel.org/stable/c/201db408872ca12cf09e36bf0f560138c3dcfa1c)
- [CNA](https://git.kernel.org/stable/c/9ec08b7499a62c6d4afa93d36ab47a43fcad57d1)
- [CNA](https://git.kernel.org/stable/c/94ae5145c520618802b0a24c047dcd5f05835db8)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.60%
- **EPSS Percentile:** 47.3

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._