[CVE-2026-89656][IMPORTANT] libceph: reject buckets with mismatched CRUSH ids

[AL-KERNEL <alkernel@kernelcve.org>]

CVE: CVE-2026-89656
Priority: IMPORTANT
AL-KERNEL base severity: IMPORTANT
KPANIC flag: YES
Patch: libceph: reject buckets with mismatched CRUSH ids
Commit: 3516a4131c4e45d62ee4e42e82c36930e8c1fbbd
Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3516a4131c4e45d62ee4e42e82c36930e8c1fbbd
Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-89656
Analysis date: Fri, 11 Sep 2026 21:59:03 -0400
ActionableScore: 7
ActionableScore lower bound: 6
Actionable bucket: Strong Important candidate
Manual review required: YES

Summary:
No one-sentence report phrase was found.

======================================================================
ABOUT THIS REPORT
======================================================================

The original Linux kernel CVE announcement for CVE-2026-89656 is available here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-89656

The original announcement does not normally provide a security severity
estimate, CVSS assessment, or enough information to determine whether the
reported kernel bug represents a practically relevant security issue.

This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin. It combines
an autonomous classifier with LLM-assisted technical analysis and a
separate ActionableScore mechanism.

The purpose of this report is to prioritize Linux kernel CVEs before
manual review, identify cases that require prompt investigation, and
support automatic closure of issues that are unlikely to have meaningful
security impact.

Published priority for this report: IMPORTANT
Manual review required: YES

A detailed explanation of the methodology and priority rules is included
at the end of this message.

======================================================================
AL-KERNEL CLASSIFICATION RESULT
======================================================================

CVE-2026-89656	IMPORTANT	https://www.kernelcve.org/list/?q=CVE-2026-89656 CHECK WITH IMPACT FROM ORIG NN IMPORTANT	Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H';*CWE-787;*CWE-20;CWE-129;Other CVSS 'AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H';BEST CVSS score: '8.1';DESCR 'A malformed Ceph CRUSH map can encode a bucket id that does not match the decoded array slot, making the mapper derive the wrong per bucket workspace index. This can make one bucket reuse another bucket workspace, and uniform bucket replica selection can then write a permutation for a larger source bucket into a smaller aliased buffer. KASAN reports a 4 byte slab OOB write in bucket_perm_choose, so the issue is kernel memory corruption rather than a pure crash bug. For the CVSS the PR:N is used because the attacker does not need local privileges on the victim if they can supply a malicious CRUSH map through a Ceph monitor path. The issue is network reachable in deployments where an attacker can act as a malicious Ceph monitor, compromise a monitor, or tamper with monitor traffic. Impact is at least denial of service via kernel crash, and in the paranoid case may include confidentiality, integrity, and availability impact due to kernel heap memory corruption.';YES REQUIRES MANUAL CHECK; ,and ActionableScore result is Strong Important candidate (with actual score 7)	YES	REMOTE WRITE KASAN OOB SIMPLEFIX NETWORK LINUS KPANIC 	NO	NO	checked

======================================================================
ACTIONABLESCORE ANALYSIS
======================================================================

ActionableScore=7
ActionableScoreLower=6
PrimitiveClass=CLASS_A
RealUAF=NO
HostAdminRequired=NO
NamespaceScopedPrivilege=NO
ImportantCandidate=YES
ManualReview=REQUIRED
AutoDowngradeAllowed=NO

1. ActionableScore

* Raw conservative score: 6
* Conservative score: 6. No floor or cap applied.
* Raw paranoid score: 7
* Paranoid score: 7. No floor or cap applied.
* Final recommended bucket: **Strong Important candidate**::

2. Signal breakdown

Conservative signals:

* +2 Strong corruption primitive. The commit establishes a kernel slab OOB write of 4 bytes in bucket_perm_choose() caused by a malformed CRUSH map.
* +2 Network-originated attacker-controlled input. The malformed CRUSH map can be supplied through the Ceph monitor/map path if the attacker controls, compromises, or can tamper with that path.
* +1 Reliable kernel crash / strong DoS. KASAN reports a slab OOB write, and kernel heap corruption in this path can realistically crash the client kernel.
* +1 Memory layout invariant restoration. The patch restores the bucket id to array slot invariant that is required for correct workspace indexing.

Paranoid additional signal:

* +1 Weak exploitation leverage concern. The write can escape the kvmalloc CRUSH workspace, and the attacker-controlled map influences the bucket identity, size relationship, and workspace aliasing condition. This is still not scored as arbitrary write or demonstrated LPE.

Non-awarded signals:

* RealUAF not awarded. This is an OOB write, not a lifetime or stale-reference bug.
* Controlled reclaim not demonstrated.
* Arbitrary or directed kernel write not demonstrated.
* Confidentiality impact not separately awarded because no disclosure path is shown.
* Integrity impact not separately awarded as a standalone consequence because no protected object modification is demonstrated beyond the kernel heap corruption primitive.
* Extra Availability not awarded because the same crash/corruption consequence is already counted once.
* Repeated release/refcount signal not applicable.
* Namespace-scoped privilege not applicable.
* Public Internet exposure not assumed. Ceph monitor traffic is usually inside storage or data-center networks.

3. Reachability analysis

The relevant attacker is a malicious or compromised Ceph monitor, a party able to tamper with monitor traffic, or an operator of an untrusted Ceph cluster to which the victim kernel client connects. The vulnerable parser is reached when libceph decodes a CRUSH map and later uses the decoded bucket id for workspace indexing.

The attacker does not need host administrator privileges on the victim if the victim already consumes the malicious map through the Ceph path. Therefore HostAdminRequired=NO. This is not a namespace-capability issue, so NamespaceScopedPrivilege=NO.

This is network-originated but not an arbitrary Internet packet bug. Practical exploitation normally requires access to the Ceph control plane or storage network trust boundary. No special local race is required by the supplied evidence. No special hardware requirement is established.

4. Primitive and severity interpretation

The exact primitive is an attacker-influenced kernel heap OOB write. crush_decode() stores buckets by array slot, while later mapping logic derives the workspace index from the decoded bucket id. A mismatched negative bucket id can cause one bucket to reuse another bucket workspace. For uniform buckets, replica selection may then expand a larger source bucket permutation into a smaller aliased buffer, producing a 4 byte slab OOB write that can escape the kvmalloc CRUSH workspace.

This is active kernel memory corruption, not a validation-only warning and not a pure NULL dereference. It is CLASS_A because the malformed CRUSH map creates a concrete OOB write in kernel memory. The demonstrated consequence is at least kernel crash / DoS. The speculative consequence is stronger exploitation from heap corruption, but arbitrary R/W, controlled reclaim, or LPE is not demonstrated.

ImportantCandidate=YES because CLASS_A kernel corruption is established and reachable through a realistic Ceph trust-boundary path. AutoDowngradeAllowed=NO because automatically closing this as ordinary Moderate would lose a concrete kernel OOB write primitive with unresolved exploitation leverage.

Likely operational severity is Important-class for affected systems using kernel Ceph clients that can receive malicious or compromised CRUSH maps, with exposure limited by Ceph deployment topology.

5. One-sentence report phrase

A malformed Ceph CRUSH map can encode a bucket id that aliases another bucket workspace, causing bucket_perm_choose() to perform a 4 byte slab OOB write in kernel memory and making this a network-originated kernel corruption issue requiring manual review.

6. Manual review recommendation

MANUAL CHECK REQUIRED

Reason: the patch fixes a concrete kernel slab OOB write reachable through attacker-controlled CRUSH map content in the Ceph monitor path, and exploitation impact beyond DoS is unresolved.

7. Call-site confidence

Call-site confidence: medium

======================================================================
UPSTREAM PATCH SUMMARY
======================================================================

Patch: libceph: reject buckets with mismatched CRUSH ids
Commit: 3516a4131c4e45d62ee4e42e82c36930e8c1fbbd
Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3516a4131c4e45d62ee4e42e82c36930e8c1fbbd

Commit description:

crush_decode() stores bucket data by array slot, and the mapper later
derives the per-bucket workspace index from the decoded bucket id. A
malformed map can therefore make one bucket reuse another bucket's
workspace by encoding an id different from -1 - slot.

For uniform buckets, the second replica selection expands the source
bucket's permutation into that aliased workspace buffer. If the source
bucket is larger than the aliased bucket, the write runs past the smaller
permutation array and can escape the kvmalloc'd CRUSH workspace. KASAN
reports a slab OOB write of 4 bytes in bucket_perm_choose().

Reject buckets whose encoded id does not match their array slot. Valid
CRUSH maps already use the canonical negative id corresponding to the
bucket slot, so this restores the invariant expected by
work->work[-1 - in->id] without changing valid map behavior.

Cc: stable@vger.kernel.org
Fixes: 66a0e2d ("crush: remove mutable part of CRUSH map")
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Changed files:
  net/ceph/osdmap.c

Diff excerpt:

Not included in this email. See the upstream URL for the full patch.

Full patch:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3516a4131c4e45d62ee4e42e82c36930e8c1fbbd

======================================================================
DETAILED REPORT METHODOLOGY
======================================================================

The original Linux kernel CVE announcement for CVE-2026-89656 can be found here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-89656

The original CVE announcement normally does not include a security-level
estimate. In particular, it may not contain a CVSS assessment, an impact
level, or enough information to determine whether the reported bug is a
practically relevant security issue. One purpose of this parallel CVE list
is to provide that missing technical and prioritization information.

The original goal of the AL-KERNEL project was to prioritize Linux kernel
CVE analysis automatically before manual review. The system can also help
identify non-security issues that may be suitable for automatic closure.

This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin.

The first analysis stage combines an autonomous classifier with additional
LLM-based analysis. The autonomous classifier runs locally on a CPU and is
based on a backpropagation neural network. Together, these mechanisms
produce a technical vulnerability description, identify likely weakness
types, estimate CVSS severity, and provide input for ActionableScore.

Two CVSS estimates are retained because incomplete kernel vulnerability
information often permits more than one defensible interpretation:

  Conservative CVSS vector: AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
  The Best / paranoid CVSS vector: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  The Best / paranoid CVSS score: 8.1

The conservative vector represents a lower-impact interpretation.
The Best/paranoid vector intentionally represents a plausible upper-bound
interpretation and should not automatically be treated as demonstrated
real-world impact.

CVSS may also need to be adjusted for a particular Linux deployment,
because actual reachability, privileges, enabled kernel configuration,
hardware, namespaces, exposed device nodes, and other environmental
conditions can differ significantly between systems.

A separate ActionableScore mechanism evaluates practical remediation
urgency. Its analysis may include reachability, attack prerequisites,
subsystem exposure, memory-corruption characteristics, denial-of-service
reliability, and possible confidentiality, integrity, or
privilege-escalation impact.

  Conservative ActionableScore: 6
  Paranoid ActionableScore: 7

The final base severity is taken directly from the second tab-separated
field of the AL-KERNEL classification result. ActionableScore does not
replace or independently override that final AL-KERNEL decision, and
if ActionableScore adjusted impact level of ALKERNEL, then you would see
self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7.

For an AL-KERNEL result of MODERATE, this report uses the following
additional presentation split:

  ActionableScore below 5   -> MODERATE REGULAR
  ActionableScore 5 or more -> MODERATE 7.0

The distinction between MODERATE REGULAR and MODERATE 7.0 makes it
possible to identify Moderate issues that should receive manual analysis
and fixes before lower-priority MODERATE REGULAR issues. In many cases,
MODERATE REGULAR fixes may wait for a later rebase or routine update.

There is one override in which MODERATE REGULAR becomes MODERATE 7.0
even when the ActionableScore is below 5. When the AL-KERNEL result
contains the KPANIC flag, a MODERATE result is always presented as
MODERATE 7.0. The KPANIC flag selected with few regexps without
usage of AI at all, so it helps to detect cases when Kernel Crash happens
and similar (to filter False-Negative results from the LLM usage).

KPANIC indicates that a reliable kernel crash, kernel panic, or similarly
serious kernel availability impact was identified by the classification
workflow.

AL-KERNEL base severity for this report: IMPORTANT
KPANIC detected for this report: YES
Published priority for this report (same as in Subject): IMPORTANT

These results are intended to support engineering triage. They are
machine-generated estimates, and cases marked for manual review should
be validated by a human security engineer before final disposition.
For more info read docs linked from here: https://kernelcve.org/
(and you can submit you own patch there to generate such a report
for non-existant CVE-id yet).

Note that in many cases this AI tool selects higher severity, than
real is (means you can expect Importants instead of Moderate 7.0 or
Moderates 7.0 instead of regular Moderates). If you see such cases,
please use reply email interface to add additional manual analyses
info to this particular CVE.
And please, please, let me know when you see Lows instead of Importants
or Important instead of Low (because particular for such cases I
need to tune this AI tool to make it better for this one and next similar).
My contact email for such notifications is alexanjelausa@gmail.com (and both
send reply to CVE record itself too and see "reply" button below for howto reply).