CVE-2026-90067

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

libceph: validate banner payload length

When parsing the Ceph messenger v2 protocol banner, the `payload_len` field

is decoded from the banner prefix. If a client sends a banner with a

`payload_len` of 0, the kernel sets up a 0-length socket read. This

violates an invariant in the state machine, triggering a warning in

`populate_in_iter()`:

------------[ cut here ]------------

!iov_iter_count(&con->v2.in_iter)

WARNING: net/ceph/messenger_v2.c:3129 at populate_in_iter

net/ceph/messenger_v2.c:3129 [inline], CPU#1: kworker/1:3/5070

WARNING: net/ceph/messenger_v2.c:3129 at ceph_con_v2_try_read+0x6634/0x6810

net/ceph/messenger_v2.c:3159, CPU#1: kworker/1:3/5070

...

Call Trace:

<TASK>

ceph_con_workfn+0x1f5/0x14a0 net/ceph/messenger.c:1575

process_one_work kernel/workqueue.c:3322 [inline]

process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405

worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486

kthread+0x388/0x470

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References