A critical out-of-bounds read vulnerability in the Linux kernel Ceph file system client, identified as CVE-2026-89651, poses a significant risk of information disclosure or system instability.

This is a memory safety flaw within the Ceph client's handle_session function. An unauthenticated remote attacker, acting as a malicious Metadata Server (MDS), can send a specially crafted CEPH_SESSION_OPEN message that lacks required bounds checks, causing the kernel to read memory beyond the allocated buffer.

The vulnerability carries a CVSS score of 9.8, reflecting its critical potential for remote exploitation without user interaction. Successful exploitation allows a malicious MDS to read sensitive kernel memory, which could result in the compromise of credentials, cryptographic keys, or other confidential data stored within the kernel space. Furthermore, the memory corruption can lead to system crashes, causing significant service disruption and downtime for organizations relying on Ceph storage infrastructures.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or later versions where the fix has been backported.

Proactive Monitoring: Monitor Ceph client logs for unusual session management errors or kernel panics that may indicate an attempt to exploit this memory corruption flaw.

Compensating Controls: Ensure that only trusted MDS nodes are permitted to communicate with Ceph clients, as the exploit requires control over the MDS to manipulate the session message flow.

Public Exploit Available: Unknown

Given the critical severity of this kernel memory vulnerability, organizations using Ceph storage should prioritize patching their Linux kernels to the specified fixed releases immediately. The lack of required bounds checks in the handle_session function makes this an attractive target for attackers who have compromised a metadata server, necessitating rapid deployment of the security updates provided by the Linux kernel maintainers.