CVE-2026-89648
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
A vulnerability was fixed in the Linux kernel in the ceph_parse_deleg_inos() function of the Ceph client. A malicious or compromised MDS server could send a reply with a huge or repeated number of delegated inode numbers, causing unbounded loops and excessive growth of the xarray in the client session. Limits were introduced on the number of delegated inodes per session and on the aggregate interval length accepted from a single reply.
Risk Assessment
An attacker or compromised MDS server could cause CPU and memory exhaustion on the Ceph client, leading to a denial of service (DoS) on systems with a mounted Ceph filesystem.
Recommendation
Update the Linux kernel to a version containing the fix for CVE-2026-89648. Until patched, limit trust in MDS servers within the Ceph cluster and monitor for unusual CPU and memory usage by Ceph clients.
Related vulnerabilities
- CVE-2026-118477Critical
The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. An authenticated attacker can execute arbitrary commands with www-data privileges. Fixed in version 2026061802.
- CVE-2026-114278Critical
The che-machine-exec service constructs a shell command by concatenating user-controlled input (username and namespace fields from /exec/init and /exec/config JSON endpoints) into a double-quoted sh -c invocation without escaping. When authentication is disabled (default), any network-reachable attacker can achieve remote code execution in containers che-machine-exec can access via shell command substitution.
- CVE-2026-112197Critical
The NoviGest Desktop App's Java RMI service lacks authentication in critical functions. An attacker with network access can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained to execute operating system commands on the server.
- CVE-2026-103799Critical
Dell PowerProtect Data Domain Management Center contains a Missing Authorization vulnerability. A low-privileged attacker with remote access could exploit it to perform unauthorized system operations on managed systems.
- CVE-2026-103792Critical
Dell PowerProtect Data Domain Management Center contains an SQL Injection vulnerability. A low-privileged attacker with remote access could exploit it to gain unauthorized access to managed systems.
- CVE-2026-103780Critical
Dell PowerProtect Data Domain contains a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with remote access could exploit it to achieve command execution.
- CVE-2026-86384Critical
Dell PowerProtect Data Domain contains a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could exploit this vulnerability, leading to credential exposure.
- CVE-2026-14571Critical
A Blind SQL Injection vulnerability in Futurum Software's management software is caused by inadequate validation and sanitisation of user-provided inputs in queries to the private area's database, as well as an incorrect WAF configuration. This weakness allows protection mechanisms to be bypassed by sending manipulated HTTP requests.
- CVE-2026-90717Critical
Dell PowerProtect Data Domain Management Center contains an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with remote access could exploit it to elevate privileges, potentially impacting other managed Data Domain systems.
- CVE-2026-86400Critical
Dell PowerProtect Data Domain contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could exploit it to execute arbitrary commands with root privileges, allowing complete system takeover.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ceph: cap delegated inode count in ceph_parse_deleg_inos() ceph_parse_deleg_inos() decodes interval sets of delegated inode numbers from an MDS create-with-delegation reply. For each set it reads a 64-bit start and a 64-bit len with ceph_decode_64_safe(), which only validates that the eight bytes are present in the message, not the value, and then loops over len while inserting entries into s_delegated_inos. len is fully attacker controlled. A malicious or compromised MDS can send one huge interval, many intervals in one reply, duplicate intervals, or repeated replies that accumulate delegated inodes on the same session. The original code bounded none of these and could spin the insert loop or grow the xarray without limit. Bound both dimensions with a single enforcement point. Track the number of delegated inodes held by each MDS session in an atomic counter and grow it only in ceph_insert_deleg_ino(), which uses atomic_add_unless() to refuse to push the count past CEPH_MAX_DELEG_INOS. Because that helper is the only place the counter grows, the per-session population can never exceed the cap, so no separate per-session pre-check is needed. The counter is decremented when async create consumes a delegated inode or when an insert fails, incremented when a delegated inode is restored, initialized with the session xarray, and reset when reconnect destroys the xarray. A per-session cap alone still lets one reply spin the insert loop on duplicate ranges without growing the counter, so also cap the aggregate interval length accepted from a single reply. Together these bound both the loop trip count per reply and the xarray population across replies. The cap is a fixed, client-chosen constant rather than a value derived from the MDS. mds_client_prealloc_inos is a userspace MDS configuration option; it is never sent to the kernel client on the wire, and a server-supplied bound could not be trusted for a defensive limit in any case. The constant is set well above that option's documented default of 1000 (a generous multiple), so legitimate refill behavior is unaffected while the CPU and xarray memory a malformed delegation stream can consume stays bounded. Impact: a malicious or compromised Ceph MDS can no longer make a client spin through an unbounded delegated-inode interval or grow one session's delegated-inode xarray without limit.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS