Junglewise Threat Intelligence

CVE-2026-46024: Linux kernel null pointer dereference in libceph ceph_handle_auth_reply

CVE-2026-46024 · Severity: info · CVSS 0 · Published 2026-05-27

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's Ceph network storage client that could cause a system crash. The issue occurs when the system receives a specifically formatted authentication message that lacks required protocol information. If exploited, this could lead to a denial-of-service (system crash), impacting the availability of services relying on Ceph storage.

Technical details

A null pointer dereference exists in the 'ceph_handle_auth_reply()' function within 'net/ceph/auth.c' in the Linux kernel. The vulnerability is triggered when a 'CEPH_MSG_AUTH_REPLY' message contains a zero value for both the protocol and the result. Under specific conditions (ac->negotiating is true and ac->protocol > 0), the code sets 'ac->protocol' to 0 and 'ac->ops' to NULL. Because the subsequent check 'ac->protocol != protocol' fails to catch the zeroed protocol, 'init_protocol()' is skipped, leading to a null pointer dereference when 'ac->ops->handle_reply()' is eventually called. This has been patched by updating the conditional check to properly validate the protocol state.

Affected products

  • Linux Linux kernel All versions prior to the fix in May 2026

Timeline

  • 2026-03-18: other: Patch authored
  • 2026-05-27: advisory: CVE-2026-46024 published

References

Related threats