01 Record

CVE-2026-89650

ceph: bound num_export_targets array for mds info v2/v3

CriticalPUBLISHEDCNA: Linux

CNA base score9.1 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

View raw JSON

02 Description

ceph: bound num_export_targets array for mds info v2/v3

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.50% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 42.6% of scored records. A rank, not a probability.

NVD base score

9.1 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

NVD analysis status

Received. NVD last modified this record on 2026-10-19.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-09-11 19:45Z1 MO AGO

Last updated

2026-10-19 08:50Z10 DAYS AGO

Reserved

2026-09-11

Assigning CNA

Linux

Record state

PUBLISHED

Severity

Critical (CVSS 9.1)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weaknesses

CWE-125Out-of-bounds ReadBase
CWE-20Improper Input ValidationClass

Data version

5.2

Document digest

4ac31fcd43e6a4ea513fac898e15e53cc1100b14c22c6aea260657cb08ba0ab0

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxd463a43d69f4af85887671d76182437775fd1631 to < 0c4bcc3ba7291d383b82ce1c2fe324f69a42da2d, d463a43d69f4af85887671d76182437775fd1631 to < 55a06b32438c222765138727d0a8164b103e8f0d, d463a43d69f4af85887671d76182437775fd1631 to < eb3e1a1cb1634c76d59c5a9cb1a026fc69d40911, d463a43d69f4af85887671d76182437775fd1631 to < 3bf7dba8dba9a05774b846affec61a3624ddba38, d463a43d69f4af85887671d76182437775fd1631 to < 58c2d3e954c13694ef6e820a5e9456461bb9e7df, d463a43d69f4af85887671d76182437775fd1631 to < 332c444f4dc6fa1e8b8637c9e82d29e97f768656, d463a43d69f4af85887671d76182437775fd1631 to < a3eb169ee297aa99670ba927c659990bd1e453f3, 4.7—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/0c4bcc3ba7291d383b82ce1c2fe324f69a42da2d
git.kernel.orghttps://git.kernel.org/stable/c/55a06b32438c222765138727d0a8164b103e8f0d
git.kernel.orghttps://git.kernel.org/stable/c/eb3e1a1cb1634c76d59c5a9cb1a026fc69d40911
git.kernel.orghttps://git.kernel.org/stable/c/3bf7dba8dba9a05774b846affec61a3624ddba38
git.kernel.orghttps://git.kernel.org/stable/c/58c2d3e954c13694ef6e820a5e9456461bb9e7df
git.kernel.orghttps://git.kernel.org/stable/c/332c444f4dc6fa1e8b8637c9e82d29e97f768656
git.kernel.orghttps://git.kernel.org/stable/c/a3eb169ee297aa99670ba927c659990bd1e453f3

07 Fixed in

Debian 12

linux
Fixed in 6.1.190-1
linux-6.12
Fixed in 6.12.111-1~deb12u1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.111-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.2.6-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.