CVE-2026-89650: ceph: bound num_export_targets array for mds info v2/v3

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ceph: bound num_export_targets array for mds info v2/v3

ceph_mdsmap_decode() in fs/ceph/mdsmap.c reads num_export_targets from
each per-mds info record and advances the decode cursor by
num_export_targets * sizeof(u32) without first checking that many bytes
remain. The only upper-bound check that catches a runaway cursor
(*p > info_end) is gated on info_v >= 4, because info_end is left NULL
for info_v 2 and 3. When the monitor sends an MDS map whose per-mds
info version is 2 or 3 with an oversized num_export_targets, the cursor
moves past the message front buffer and the later export-targets loop
calls the unchecked ceph_decode_32() on out-of-bounds memory.

A kernel client processes CEPH_MSG_MDS_MAP from its monitor session
(net/ceph/mon_client.c dispatches it; fs/ceph/super.c routes it to
ceph_mdsc_handle_mdsmap(), which sets end to the front buffer bound and
calls ceph_mdsmap_decode()). A malicious or compromised monitor, or an
on-path attacker on an unsigned/unencrypted messenger session, can
therefore drive an out-of-bounds read in the client kernel; on x86_64
with KASAN it is reported as a slab-out-of-bounds read in
ceph_mdsmap_decode(). The decoded values land in the internal
info->export_targets[] array, so the consequence is a kernel
out-of-bounds read, not an information leak to the attacker.

Impact: a malicious or compromised Ceph monitor sending an MDS map with
a per-mds info version of 2 or 3 and an oversized num_export_targets
field triggers an out-of-bounds read in the CephFS client kernel.

Add a ceph_decode_need() for the export-targets array before advancing
the cursor, so the bound is enforced for every info_v >= 2, not only
info_v >= 4. This mirrors the count-then-need idiom already used for
m_data_pg_pools later in the same function.

Compute the export-targets byte count with size_mul() and reuse that
checked length when advancing the cursor, so the attacker-controlled
num_export_targets multiplication fails closed on overflow rather than
relying on the later kcalloc() guard.

The Linux kernel CVE team has assigned CVE-2026-89650 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.7 with commit d463a43d69f4af85887671d76182437775fd1631 and fixed in 6.12.109 with commit 3bf7dba8dba9a05774b846affec61a3624ddba38
	Issue introduced in 4.7 with commit d463a43d69f4af85887671d76182437775fd1631 and fixed in 6.18.50 with commit 58c2d3e954c13694ef6e820a5e9456461bb9e7df
	Issue introduced in 4.7 with commit d463a43d69f4af85887671d76182437775fd1631 and fixed in 7.2.4 with commit 332c444f4dc6fa1e8b8637c9e82d29e97f768656
	Issue introduced in 4.7 with commit d463a43d69f4af85887671d76182437775fd1631 and fixed in 7.3-rc1 with commit a3eb169ee297aa99670ba927c659990bd1e453f3

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-89650
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/ceph/mdsmap.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3bf7dba8dba9a05774b846affec61a3624ddba38
	https://git.kernel.org/stable/c/58c2d3e954c13694ef6e820a5e9456461bb9e7df
	https://git.kernel.org/stable/c/332c444f4dc6fa1e8b8637c9e82d29e97f768656
	https://git.kernel.org/stable/c/a3eb169ee297aa99670ba927c659990bd1e453f3