Executive brief
A vulnerability in the Linux kernel's Ceph file system client could allow a local user to cause a system crash or potentially gain unauthorized privileges. Ceph is a distributed storage system often used in cloud environments and data centers. The issue stems from improper initialization of internal data structures, which can lead to memory corruption during file operations.
Technical details
A vulnerability exists in the Linux kernel Ceph file system driver due to missing zero-initialization of the 'ceph_path_info' structure before calling 'ceph_mdsc_build_path()'. If 'ceph_mdsc_build_path()' fails, it does not initialize the structure, but subsequent calls to 'ceph_mdsc_free_path_info()' proceed to process the uninitialized data. This results in a 'kmem_cache_free' call on invalid or incorrect slab pages, leading to a kernel BUG or Oops. The flaw affects multiple components including debugfs, directory operations, and file opening routines. Patches have been released for various stable kernel branches to ensure the structure is zero-initialized at the call site.
Affected products
- Linux Linux Kernel 6.12.48 to 6.12.78, 6.16.8 to 6.17, 6.17.1 to 6.18.19, 6.19 to 6.19.9
Timeline
- 2026-02-24: other: Patch authored
- 2026-05-08: advisory: Initial publication of CVE-2026-43408