{"api_version":"1","generated_at":"2026-09-12T11:23:58+00:00","cve":"CVE-2026-89656","urls":{"html":"https://cve.report/CVE-2026-89656","api":"https://cve.report/api/cve/CVE-2026-89656.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-89656","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-89656"},"summary":{"title":"libceph: reject buckets with mismatched CRUSH ids","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: reject buckets with mismatched CRUSH ids\n\ncrush_decode() stores bucket data by array slot, and the mapper later\nderives the per-bucket workspace index from the decoded bucket id. A\nmalformed map can therefore make one bucket reuse another bucket's\nworkspace by encoding an id different from -1 - slot.\n\nFor uniform buckets, the second replica selection expands the source\nbucket's permutation into that aliased workspace buffer. If the source\nbucket is larger than the aliased bucket, the write runs past the smaller\npermutation array and can escape the kvmalloc'd CRUSH workspace. KASAN\nreports a slab OOB write of 4 bytes in bucket_perm_choose().\n\nReject buckets whose encoded id does not match their array slot. Valid\nCRUSH maps already use the canonical negative id corresponding to the\nbucket slot, so this restores the invariant expected by\nwork->work[-1 - in->id] without changing valid map behavior.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-11 20:19:51","updated_at":"2026-09-11 20:19:51"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/3cde4a8302301679937474a5f7a851394cc1bd11","name":"https://git.kernel.org/stable/c/3cde4a8302301679937474a5f7a851394cc1bd11","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/79900d978158b2d80eef952fc41b9e4dc58d7b83","name":"https://git.kernel.org/stable/c/79900d978158b2d80eef952fc41b9e4dc58d7b83","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/00562ccd4e88d092b9b851df50fad20442bfeb24","name":"https://git.kernel.org/stable/c/00562ccd4e88d092b9b851df50fad20442bfeb24","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/3516a4131c4e45d62ee4e42e82c36930e8c1fbbd","name":"https://git.kernel.org/stable/c/3516a4131c4e45d62ee4e42e82c36930e8c1fbbd","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89656","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89656","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 66a0e2d579dbec5c676cfe446234ffebb267c564 3516a4131c4e45d62ee4e42e82c36930e8c1fbbd git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 66a0e2d579dbec5c676cfe446234ffebb267c564 00562ccd4e88d092b9b851df50fad20442bfeb24 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 66a0e2d579dbec5c676cfe446234ffebb267c564 79900d978158b2d80eef952fc41b9e4dc58d7b83 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 66a0e2d579dbec5c676cfe446234ffebb267c564 3cde4a8302301679937474a5f7a851394cc1bd11 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.11","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.11 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.109 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.50 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.4 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ceph/osdmap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3516a4131c4e45d62ee4e42e82c36930e8c1fbbd","status":"affected","version":"66a0e2d579dbec5c676cfe446234ffebb267c564","versionType":"git"},{"lessThan":"00562ccd4e88d092b9b851df50fad20442bfeb24","status":"affected","version":"66a0e2d579dbec5c676cfe446234ffebb267c564","versionType":"git"},{"lessThan":"79900d978158b2d80eef952fc41b9e4dc58d7b83","status":"affected","version":"66a0e2d579dbec5c676cfe446234ffebb267c564","versionType":"git"},{"lessThan":"3cde4a8302301679937474a5f7a851394cc1bd11","status":"affected","version":"66a0e2d579dbec5c676cfe446234ffebb267c564","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ceph/osdmap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.11"},{"lessThan":"4.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.109","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.50","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.109","versionStartIncluding":"4.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.50","versionStartIncluding":"4.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.4","versionStartIncluding":"4.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc1","versionStartIncluding":"4.11","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: reject buckets with mismatched CRUSH ids\n\ncrush_decode() stores bucket data by array slot, and the mapper later\nderives the per-bucket workspace index from the decoded bucket id. A\nmalformed map can therefore make one bucket reuse another bucket's\nworkspace by encoding an id different from -1 - slot.\n\nFor uniform buckets, the second replica selection expands the source\nbucket's permutation into that aliased workspace buffer. If the source\nbucket is larger than the aliased bucket, the write runs past the smaller\npermutation array and can escape the kvmalloc'd CRUSH workspace. KASAN\nreports a slab OOB write of 4 bytes in bucket_perm_choose().\n\nReject buckets whose encoded id does not match their array slot. Valid\nCRUSH maps already use the canonical negative id corresponding to the\nbucket slot, so this restores the invariant expected by\nwork->work[-1 - in->id] without changing valid map behavior."}],"providerMetadata":{"dateUpdated":"2026-09-11T19:45:45.483Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/3516a4131c4e45d62ee4e42e82c36930e8c1fbbd"},{"url":"https://git.kernel.org/stable/c/00562ccd4e88d092b9b851df50fad20442bfeb24"},{"url":"https://git.kernel.org/stable/c/79900d978158b2d80eef952fc41b9e4dc58d7b83"},{"url":"https://git.kernel.org/stable/c/3cde4a8302301679937474a5f7a851394cc1bd11"}],"title":"libceph: reject buckets with mismatched CRUSH ids","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-89656","datePublished":"2026-09-11T19:45:45.483Z","dateReserved":"2026-09-11T19:38:34.743Z","dateUpdated":"2026-09-11T19:45:45.483Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-11 20:19:51","lastModifiedDate":"2026-09-11 20:19:51","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"89656","Ordinal":"1","Title":"libceph: reject buckets with mismatched CRUSH ids","CVE":"CVE-2026-89656","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"89656","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: reject buckets with mismatched CRUSH ids\n\ncrush_decode() stores bucket data by array slot, and the mapper later\nderives the per-bucket workspace index from the decoded bucket id. A\nmalformed map can therefore make one bucket reuse another bucket's\nworkspace by encoding an id different from -1 - slot.\n\nFor uniform buckets, the second replica selection expands the source\nbucket's permutation into that aliased workspace buffer. If the source\nbucket is larger than the aliased bucket, the write runs past the smaller\npermutation array and can escape the kvmalloc'd CRUSH workspace. KASAN\nreports a slab OOB write of 4 bytes in bucket_perm_choose().\n\nReject buckets whose encoded id does not match their array slot. Valid\nCRUSH maps already use the canonical negative id corresponding to the\nbucket slot, so this restores the invariant expected by\nwork->work[-1 - in->id] without changing valid map behavior.","Type":"Description","Title":"libceph: reject buckets with mismatched CRUSH ids"}]}}}