Executive brief
A vulnerability was identified in the Linux kernel's Ceph network storage client that could cause a system crash. The issue occurs when the system receives a specifically formatted authentication message that lacks required protocol information. If exploited, this could lead to a denial-of-service (system crash), impacting the availability of services relying on Ceph storage.
Technical details
A null pointer dereference exists in the 'ceph_handle_auth_reply()' function within 'net/ceph/auth.c' in the Linux kernel. The vulnerability is triggered when a 'CEPH_MSG_AUTH_REPLY' message contains a zero value for both the protocol and the result. Under specific conditions (ac->negotiating is true and ac->protocol > 0), the code sets 'ac->protocol' to 0 and 'ac->ops' to NULL. Because the subsequent check 'ac->protocol != protocol' fails to catch the zeroed protocol, 'init_protocol()' is skipped, leading to a null pointer dereference when 'ac->ops->handle_reply()' is eventually called. This has been patched by updating the conditional check to properly validate the protocol state.
Affected products
- Linux Linux kernel All versions prior to the fix in May 2026
Timeline
- 2026-03-18: other: Patch authored
- 2026-05-27: advisory: CVE-2026-46024 published
References
- https://git.kernel.org/stable/c/016bc663657366d386993f63eb31072eb45a2b77
- https://git.kernel.org/stable/c/4b2738b93edad661178340239de657d876b73d3d
- https://git.kernel.org/stable/c/5199c125d25aeae8615c4fc31652cc0fe624338e
- https://git.kernel.org/stable/c/8f2be7285941a33a9f72579a23b96392f83c758e
- https://git.kernel.org/stable/c/927e4bd5692f2a4901808822981fb2c8d4456548