CVE-2026-90067 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
libceph: validate banner payload length
When parsing the Ceph messenger v2 protocol banner, the `payload_len` field is decoded from the banner prefix. If a client sends a banner with a `payload_len` of 0, the kernel sets up a 0-length socket read. This violates an invariant in the state machine, triggering a warning in `populate_in_iter()`:
------------[ cut here ]------------
!iov_iter_count(&con->v2.in_iter) WARNING: net/ceph/messenger_v2.c:3129 at populate_in_iter net/ceph/messenger_v2.c:3129 [inline], CPU#1: kworker/1:3/5070
WARNING: net/ceph/messenger_v2.c:3129 at ceph_con_v2_try_read+0x6634/0x6810 net/ceph/messenger_v2.c:3159, CPU#1: kworker/1:3/5070 ... Call Trace: <TASK> ceph_con_workfn+0x1f5/0x14a0 net/ceph/messenger.c:1575 process_one_work kernel/workqueue.c:3322 [inline]
process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK>
According to the msgr2 protocol specification, the banner payload is expected to contain at least two 64-bit integers (`server_feat` and `server_req_feat`). Therefore, `payload_len` must be at least 16 bytes.
Fix this by adding a check in `process_banner_prefix()` to reject a `payload_len` smaller than 16 bytes. This prevents the 0-length read and correctly aborts the connection with a protocol error.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's Ceph distributed file system implementation contains a validation flaw within its messenger v2 protocol handler, specifically in the processing of the initial banner payload. The vulnerability arises when parsing the header prefix where the `payload_len` field is decoded from incoming network data. Under normal operational conditions, this length value dictates how much subsequent data should be read into memory buffers to establish the connection state machine. However, if a remote client or malicious actor sends a crafted banner with a `payload_len` of zero, the kernel proceeds to configure a socket read operation for zero bytes. This action directly violates an internal invariant required by the Ceph messenger v2 state machine, which expects valid initialization data before proceeding further in the connection handshake process.
The immediate technical consequence of this invalid input is triggered within the `populate_in_iter()` function located in net/ceph/messenger_v2.c. The kernel detects that the iterator count for incoming connections is zero when it should be non-zero, resulting in a critical warning being logged to the system console. While this specific flaw manifests primarily as a denial of service through kernel warnings and potential connection abortion rather than arbitrary code execution or privilege escalation, it represents a significant reliability issue. The protocol specification mandates that the banner payload must contain at least two 64-bit integers representing server features and requested features, requiring a minimum length of sixteen bytes. By accepting payloads shorter than this threshold, the implementation fails to enforce basic protocol compliance checks before attempting to process them as valid connection parameters.
From an industry standard perspective, this vulnerability is classified under CWE-20 Improper Input Validation because the application does not adequately verify that input data meets expected structural requirements prior to processing. Furthermore, it aligns with ATT&CK technique T1498 Network Denial of Service, specifically sub-technique T1498.003 Impact via Exploitation of Protocol Vulnerabilities, as an attacker can disrupt service availability by triggering kernel warnings and forcing connection resets through malformed protocol messages. The lack of strict length validation allows for the exploitation of state machine inconsistencies that degrade system stability and operational continuity within Ceph clusters relying on this communication layer.
To mitigate this vulnerability, developers have implemented a corrective check in the `process_banner_prefix()` function to explicitly reject any banner payload with a length smaller than sixteen bytes. This fix ensures that connections attempting to establish themselves using malformed or incomplete headers are aborted immediately with an appropriate protocol error rather than proceeding into invalid states. System administrators should ensure their Ceph clusters are updated with kernel patches containing this validation logic. Additionally, network-level monitoring tools can be configured to detect and block abnormal messenger v2 traffic patterns characterized by unusually short initial handshake payloads, providing a secondary layer of defense against potential exploitation attempts targeting the protocol initialization phase.