Executive brief
A vulnerability in the Linux kernel's Ceph storage client could allow for the accidental disclosure of sensitive system memory. When the system receives a specifically formatted or corrupted authentication message from a storage server, it may inadvertently send back data from its own internal memory buffers. This could potentially expose small amounts of system information to the network.
Technical details
A vulnerability exists in the libceph module of the Linux kernel due to improper validation of the 'result' field in CEPH_MSG_AUTH_REPLY messages. In ceph_handle_auth_reply(), a positive value in the result field is incorrectly treated as an error code and passed to handle_auth_reply(). This value is subsequently used as the length for the front segment of a CEPH_MSG_AUTH message. If this value exceeds the preallocated buffer size (front_alloc_len), an out-of-bounds read occurs, causing the kernel to transmit adjacent slab memory over the network. The fix ensures only negative values are treated as errors and adds a BUG_ON check to prevent out-of-bounds lengths from being processed.
Affected products
- Linux Linux Kernel All versions prior to the May 2026 patches
Timeline
- 2026-04-21: other: Patch submitted by developer
- 2026-05-28: advisory: CVE published in NVD
References
- https://git.kernel.org/stable/c/1c439de70b1c3eb3c6bffa8245c16b9fc318f114
- https://git.kernel.org/stable/c/2ae0afd98432536562fa8261538ae795446f0589
- https://git.kernel.org/stable/c/408e85ee708b6aa03eeb0220ffa0915f4d407181
- https://git.kernel.org/stable/c/8517b6c8d2c759918ba0058cb6c7e14d59643202
- https://git.kernel.org/stable/c/b7df9fbd4869fdfe09a3f501ffd228486521e062