libceph: validate banner payload length
Summary
| CVE | CVE-2026-90067 |
|---|
| State | PUBLISHED |
|---|
| Assigner | Linux |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2026-09-17 17:16:55 UTC |
|---|
| Updated | 2026-09-17 17:16:55 UTC |
|---|
| Description | In the Linux kernel, the following vulnerability has been resolved:
libceph: validate banner payload length
When parsing the Ceph messenger v2 protocol banner, the `payload_len` field
is decoded from the banner prefix. If a client sends a banner with a
`payload_len` of 0, the kernel sets up a 0-length socket read. This
violates an invariant in the state machine, triggering a warning in
`populate_in_iter()`:
------------[ cut here ]------------
!iov_iter_count(&con->v2.in_iter)
WARNING: net/ceph/messenger_v2.c:3129 at populate_in_iter
net/ceph/messenger_v2.c:3129 [inline], CPU#1: kworker/1:3/5070
WARNING: net/ceph/messenger_v2.c:3129 at ceph_con_v2_try_read+0x6634/0x6810
net/ceph/messenger_v2.c:3159, CPU#1: kworker/1:3/5070
...
Call Trace:
<TASK>
ceph_con_workfn+0x1f5/0x14a0 net/ceph/messenger.c:1575
process_one_work kernel/workqueue.c:3322 [inline]
process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
According to the msgr2 protocol specification, the banner payload is
expected to contain at least two 64-bit integers (`server_feat` and
`server_req_feat`). Therefore, `payload_len` must be at least 16 bytes.
Fix this by adding a check in `process_banner_prefix()` to reject a
`payload_len` smaller than 16 bytes. This prevents the 0-length read and
correctly aborts the connection with a protocol error. |
|---|
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|
| CNA |
Linux |
Linux |
affected cd1a677cad994021b19665ed476aea63f5d54f31 279c0852999fd2384f4a88155091a99e81f96873 git |
Not specified |
| CNA |
Linux |
Linux |
affected cd1a677cad994021b19665ed476aea63f5d54f31 6cf666e47f2b51d5a887ec8a3226cde951757d27 git |
Not specified |
| CNA |
Linux |
Linux |
affected cd1a677cad994021b19665ed476aea63f5d54f31 3b2e62a7655d347a845a91155610ddae11daffc6 git |
Not specified |
| CNA |
Linux |
Linux |
affected cd1a677cad994021b19665ed476aea63f5d54f31 c1b937ff24b19e69aa7fb1b0f46a74d4c9668692 git |
Not specified |
| CNA |
Linux |
Linux |
affected cd1a677cad994021b19665ed476aea63f5d54f31 6d1c6f228854aa89844fd0152d7ed7ac72a55e89 git |
Not specified |
| CNA |
Linux |
Linux |
affected cd1a677cad994021b19665ed476aea63f5d54f31 c77633a9595658210a6e216a071e5a396a0835a7 git |
Not specified |
| CNA |
Linux |
Linux |
affected cd1a677cad994021b19665ed476aea63f5d54f31 f374967fcdf04001c9b66df1c19106fa83cd91f7 git |
Not specified |
| CNA |
Linux |
Linux |
affected 5.11 |
Not specified |
| CNA |
Linux |
Linux |
unaffected 5.11 semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 5.15.221 5.15.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.1.188 6.1.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.6.157 6.6.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.12.110 6.12.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.18.52 6.18.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.2.6 7.2.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.3-rc1 * original_commit_for_fix |
Not specified |
References
| Reference | Source | Link | Tags |
|---|
| git.kernel.org/stable/c/f374967fcdf04001c9b66df1c19106fa83cd91f7 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/279c0852999fd2384f4a88155091a99e81f96873 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/c1b937ff24b19e69aa7fb1b0f46a74d4c9668692 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/6cf666e47f2b51d5a887ec8a3226cde951757d27 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/3b2e62a7655d347a845a91155610ddae11daffc6 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/6d1c6f228854aa89844fd0152d7ed7ac72a55e89 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/c77633a9595658210a6e216a071e5a396a0835a7 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.