EUVD-2026-76564
GHSA-rgf4-v7fw-49xj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Needs a malicious/MITM MDS on the storage network (AV:A) plus non-default CephFS-over-NFS re-export and a length race (AC:H); OOB write yields I/A impact, no direct disclosure (C:N).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ceph: bound copied dentry name length in NFS export get_name
ceph_get_name() copies the MDS-supplied name into the caller's NAME_MAX-sized buffer with memcpy(name, rinfo->dname, rinfo->dname_len) and then writes name[rinfo->dname_len] = 0, without checking dname_len against NAME_MAX. A malicious or buggy MDS that returns a LOOKUPNAME reply with dname_len > NAME_MAX overflows the buffer. __get_snap_name() copies rde->name / rde->name_len the same unchecked way.
Impact: a malicious or compromised Ceph MDS overflows the NAME_MAX name buffer in a client's NFS-export get_name path, a slab out-of-bounds write reported by KASAN. Reachable when a CephFS mount is re-exported over NFS.
Add ceph_export_copy_name(), which rejects lengths above NAME_MAX with -ENAMETOOLONG before the copy, and use it in both ceph_get_name() and __get_snap_name().
AnalysisAI
Slab out-of-bounds write in the Linux kernel's CephFS client (ceph_get_name() and __get_snap_name()) lets a malicious or compromised Ceph MDS overflow a NAME_MAX-sized name buffer during NFS-export name resolution. The code copies the MDS-supplied dentry name (rinfo->dname / rde->name) via memcpy and writes a NUL terminator at dname_len without ever checking dname_len against NAME_MAX, so a LOOKUPNAME reply with an oversized name corrupts adjacent slab memory (flagged by KASAN). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires (1) a malicious, compromised, or MITM'd Ceph MDS able to return a crafted LOOKUPNAME/readdir reply with dname_len or name_len greater than NAME_MAX (255), and (2) the victim client must be configured to re-export a mounted CephFS over NFS - the get_name export path is only invoked in that topology. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) materially overstates real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1 (or later), which add ceph_export_copy_name() to reject names longer than NAME_MAX with -ENAMETOOLONG before the copy; apply your distribution's backport as soon as it ships. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Begin immediately by auditing systems to identify any CephFS mounts that are re-exported over NFS, as this is the only attack vector; most organizations without this infrastructure pattern can defer patching. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today