cbcvebase.
CVE-2026-43407
published 2026-05-08

CVE-2026-43407: In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() This patch fixes an…

PriorityP352critical9.1CVSS 3.1
AVNACLPRNUINSUCHINAH
EPSS
0.54%
42.0th percentile
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() This patch fixes an out-of-bounds access in ceph_handle_auth_reply() that can be triggered by a message of type CEPH_MSG_AUTH_REPLY. In ceph_handle_auth_reply(), the value of the payload_len field of such a message is stored in a variable of type int. A value greater than INT_MAX leads to an integer overflow and is interpreted as a negative value. This leads to decrementing the pointer address by this value and subsequently accessing it because ceph_decode_need() only checks that the memory access does not exceed the end address of the allocation. This patch fixes the issue by changing the data type of payload_len to u32. Additionally, the data type of result_msg_len is changed to u32, as it is also a variable holding a non-negative length. Also, an additional layer of sanity checks is introduced, ensuring that directly after reading it from the message, payload_len and result_msg_len are not greater than the overall segment length. BUG: KASAN: slab-out-of-bounds in ceph_handle_auth_reply+0x642/0x7a0 [libceph] Read of size 4 at addr ffff88811404df14 by task kworker/20:1/262 CPU: 20 UID: 0 PID: 262 Comm: kworker/20:1 Not tainted 6.19.2 #5 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: ceph-msgr ceph_con_workfn [libceph] Call Trace: dump_stack_lvl+0x76/0xa0 print_report+0xd1/0x620 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? kasan_complete_mode_report_info+0x72/0x210 kasan_report+0xe7/0x130 ? ceph_handle_auth_reply+0x642/0x7a0 [libceph] ? ceph_handle_auth_reply+0x642/0x7a0 [libceph] __asan_report_load_n_noabort+0xf/0x20 ceph_handle_auth_reply+0x642/0x7a0 [libceph] mon_dispatch+0x973/0x23d0 [libceph] ? apparmor_socket_recvmsg+0x6b/0xa0 ? __pfx_mon_dispatch+0x10/0x10 [libceph] ? __kasan_check_write+0x14/0x30i ? mutex_unlock+0x7f/0xd0 ? __pfx_mutex_unlo

Affected

67 ranges· showing 25
VendorProductVersion rangeFixed in
linuxlinux
linuxlinux>= 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc < ea080b21092590122c3f971cf588932cdbf47847ea080b21092590122c3f971cf588932cdbf47847
linuxlinux>= 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc < edc678e5cd11730a2834b43071d8923f05bc334dedc678e5cd11730a2834b43071d8923f05bc334d
linuxlinux>= 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc < 6cee34d6669fe176b4259131adb1a145c939b4726cee34d6669fe176b4259131adb1a145c939b472
linuxlinux>= 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc < 8bb87547e92dcf0928ed763c60e0ac8d733c36568bb87547e92dcf0928ed763c60e0ac8d733c3656
linuxlinux>= 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc < ed024d2f4c79c0eb2464df0fb640610ac301f9a0ed024d2f4c79c0eb2464df0fb640610ac301f9a0
linuxlinux>= 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc < f9da5c1bbac5c8e33259fe00ed7347438fffa969f9da5c1bbac5c8e33259fe00ed7347438fffa969
linuxlinux>= 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc < 9f9e2297f45fc2d2524eb104c289d69ddef956659f9e2297f45fc2d2524eb104c289d69ddef95665
linuxlinux>= 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc < b282c43ed156ae15ea76748fc15cd5c39dc9ab72b282c43ed156ae15ea76748fc15cd5c39dc9ab72
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel>= 2.6.34.1 < 5.10.2535.10.253
linuxlinux_kernel>= 5.11 < 5.15.2035.15.203
linuxlinux_kernel>= 5.16 < 6.1.1676.1.167
linuxlinux_kernel>= 6.13 < 6.18.196.18.19
linuxlinux_kernel>= 6.19 < 6.19.96.19.9
linuxlinux_kernel>= 6.2 < 6.6.1306.6.130
linuxlinux_kernel>= 6.7 < 6.12.786.12.78
ubuntulinux
ubuntulinux-aws
ubuntulinux-aws-5.15
ubuntulinux-aws-6.8
ubuntulinux-aws-fips
ubuntulinux-azure

CVSS provenance

nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vendor_ubuntu8.8HIGH
vendor_redhat7.0MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.