CVE-2026-43408
published 2026-05-08CVE-2026-43408: In the Linux kernel, the following vulnerability has been resolved: ceph: add a bunch of missing ceph_path_info initializers ceph_mdsc_build_path() must be…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.13%
2.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
ceph: add a bunch of missing ceph_path_info initializers
ceph_mdsc_build_path() must be called with a zero-initialized
ceph_path_info parameter, or else the following
ceph_mdsc_free_path_info() may crash.
Example crash (on Linux 6.18.12):
virt_to_cache: Object is not a Slab page!
WARNING: CPU: 184 PID: 2871736 at mm/slub.c:6732 kmem_cache_free+0x316/0x400
[...]
Call Trace:
[...]
ceph_open+0x13d/0x3e0
do_dentry_open+0x134/0x480
vfs_open+0x2a/0xe0
path_openat+0x9a3/0x1160
[...]
cache_from_obj: Wrong slab cache. names_cache but object is from ceph_inode_info
WARNING: CPU: 184 PID: 2871736 at mm/slub.c:6746 kmem_cache_free+0x2dd/0x400
[...]
kernel BUG at mm/slub.c:634!
Oops: invalid opcode: 0000 [#1] SMP NOPTI
RIP: 0010:__slab_free+0x1a4/0x350
Some of the ceph_mdsc_build_path() callers had initializers, but
others had not, even though they were all added by commit 15f519e9f883
("ceph: fix race condition validating r_parent before applying state").
The ones without initializer are suspectible to random crashes. (I can
imagine it could even be possible to exploit this bug to elevate
privileges.)
Unfortunately, these Ceph functions are undocumented and its semantics
can only be derived from the code. I see that ceph_mdsc_build_path()
initializes the structure only on success, but not on error.
Calling ceph_mdsc_free_path_info() after a failed
ceph_mdsc_build_path() call does not even make sense, but that's what
all callers do, and for it to be safe, the structure must be
zero-initialized. The least intrusive approach to fix this is
therefore to add initializers everywhere.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 15f519e9f883b316d86e2bb6b767a023aafd9d83 < 8be8911f590813e6f90bc6407ced1b23e50bc5da | 8be8911f590813e6f90bc6407ced1b23e50bc5da |
| linux | linux | >= 15f519e9f883b316d86e2bb6b767a023aafd9d83 < 453df1f4535842bf17ff1885a225e153d7ee3374 | 453df1f4535842bf17ff1885a225e153d7ee3374 |
| linux | linux | >= 15f519e9f883b316d86e2bb6b767a023aafd9d83 < 43323a5934b660afae687e8e4e95ac328615a5c4 | 43323a5934b660afae687e8e4e95ac328615a5c4 |
| linux | linux | >= 6.12.48 < 6.12.78 | 6.12.78 |
| linux | linux | >= 6.16.8 < 6.17 | 6.17 |
| linux | linux | >= db378e6f83ec705c6091c65d482d555edc2b0a72 < 644b47f0574fd82aeb9d00317eca8d1f2a525c8c | 644b47f0574fd82aeb9d00317eca8d1f2a525c8c |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 6.12.48 < 6.12.78 | 6.12.78 |
| linux | linux_kernel | >= 6.16.8 < 6.17 | 6.17 |
| linux | linux_kernel | >= 6.17.1 < 6.18.19 | 6.18.19 |
| linux | linux_kernel | >= 6.19 < 6.19.9 | 6.19.9 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.12.77/6.18.18/6.19.8 mm/slub.c ceph_mdsc_build_path ceph_path_info race condition (Nessus ID 313437)
vuldb·2026-05-22·CVSS 7.8
CVE-2026-43408 [HIGH] Linux Kernel up to 6.12.77/6.18.18/6.19.8 mm/slub.c ceph_mdsc_build_path ceph_path_info race condition (Nessus ID 313437)
A vulnerability marked as critical has been reported in Linux Kernel up to 6.12.77/6.18.18/6.19.8. This affects the function ceph_mdsc_build_path of the file mm/slub.c. The manipulation of the argument ceph_path_info leads to race condition.
This vulnerability is uniquely identified as CVE-2026-43408. The attack can only be initiated within the local network. No exploit exists.
It is suggested to upgrade the affected component.
GHSA
GHSA-97qv-cc94-mr6w: In the Linux kernel, the following vulnerability has been resolved:
ceph: add a bunch of missing ceph_path_info initializers
ceph_mdsc_build_path()
ghsa_unreviewed·2026-05-08
CVE-2026-43408 GHSA-97qv-cc94-mr6w: In the Linux kernel, the following vulnerability has been resolved:
ceph: add a bunch of missing ceph_path_info initializers
ceph_mdsc_build_path()
In the Linux kernel, the following vulnerability has been resolved:
ceph: add a bunch of missing ceph_path_info initializers
ceph_mdsc_build_path() must be called with a zero-initialized
ceph_path_info parameter, or else the following
ceph_mdsc_free_path_info() may crash.
Example crash (on Linux 6.18.12):
virt_to_cache: Object is not a Slab page!
WARNING: CPU: 184 PID: 2871736 at mm/slub.c:6732 kmem_cache_free+0x316/0x400
[...]
Call Trace:
[...]
ceph_open+0x13d/0x3e0
do_dentry_open+0x134/0x480
vfs_open+0x2a/0xe0
path_openat+0x9a3/0x1160
[...]
cache_from_obj: Wrong slab cache. names_cache but object is from ceph_inode_info
WARNING: CPU: 184 PID: 2871736 at mm/slub.c:6746 kmem_cache_free+0x2dd/0x400
[...]
kernel BUG at mm/slub.c:634!
Oops: invalid opcode: 0000 [#1] SMP NOPTI
RIP: 0010:__
Red Hat
kernel: ceph: add a bunch of missing ceph_path_info initializers
vendor_redhat·2026-05-08·CVSS 7.0
CVE-2026-43408 [MEDIUM] CWE-908 kernel: ceph: add a bunch of missing ceph_path_info initializers
kernel: ceph: add a bunch of missing ceph_path_info initializers
A flaw was found in the Ceph file system component of the Linux kernel. This vulnerability arises from the failure to properly initialize a data structure (ceph_path_info) before its use, specifically when the ceph_mdsc_build_path() function is called. This oversight can lead to system instability and crashes, resulting in a Denial of Service (DoS). While not definitively proven, there is a potential for this flaw to be exploited for privilege escalation.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Ente
No detection rules found.
No public exploits indexed.
2026-05-08
Published