GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-43407 (GCVE-0-2026-43407)

Vulnerability from cvelistv5 – Published: 2026-05-08 14:21 – Updated: 2026-08-05 12:27
VLAI
Title
libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
Summary
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() This patch fixes an out-of-bounds access in ceph_handle_auth_reply() that can be triggered by a message of type CEPH_MSG_AUTH_REPLY. In ceph_handle_auth_reply(), the value of the payload_len field of such a message is stored in a variable of type int. A value greater than INT_MAX leads to an integer overflow and is interpreted as a negative value. This leads to decrementing the pointer address by this value and subsequently accessing it because ceph_decode_need() only checks that the memory access does not exceed the end address of the allocation. This patch fixes the issue by changing the data type of payload_len to u32. Additionally, the data type of result_msg_len is changed to u32, as it is also a variable holding a non-negative length. Also, an additional layer of sanity checks is introduced, ensuring that directly after reading it from the message, payload_len and result_msg_len are not greater than the overall segment length. BUG: KASAN: slab-out-of-bounds in ceph_handle_auth_reply+0x642/0x7a0 [libceph] Read of size 4 at addr ffff88811404df14 by task kworker/20:1/262 CPU: 20 UID: 0 PID: 262 Comm: kworker/20:1 Not tainted 6.19.2 #5 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: ceph-msgr ceph_con_workfn [libceph] Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 print_report+0xd1/0x620 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? kasan_complete_mode_report_info+0x72/0x210 kasan_report+0xe7/0x130 ? ceph_handle_auth_reply+0x642/0x7a0 [libceph] ? ceph_handle_auth_reply+0x642/0x7a0 [libceph] __asan_report_load_n_noabort+0xf/0x20 ceph_handle_auth_reply+0x642/0x7a0 [libceph] mon_dispatch+0x973/0x23d0 [libceph] ? apparmor_socket_recvmsg+0x6b/0xa0 ? __pfx_mon_dispatch+0x10/0x10 [libceph] ? __kasan_check_write+0x14/0x30i ? mutex_unlock+0x7f/0xd0 ? __pfx_mutex_unlock+0x10/0x10 ? __pfx_do_recvmsg+0x10/0x10 [libceph] ceph_con_process_message+0x1f1/0x650 [libceph] process_message+0x1e/0x450 [libceph] ceph_con_v2_try_read+0x2e48/0x6c80 [libceph] ? __pfx_ceph_con_v2_try_read+0x10/0x10 [libceph] ? save_fpregs_to_fpstate+0xb0/0x230 ? raw_spin_rq_unlock+0x17/0xa0 ? finish_task_switch.isra.0+0x13b/0x760 ? __switch_to+0x385/0xda0 ? __kasan_check_write+0x14/0x30 ? mutex_lock+0x8d/0xe0 ? __pfx_mutex_lock+0x10/0x10 ceph_con_workfn+0x248/0x10c0 [libceph] process_one_work+0x629/0xf80 ? __kasan_check_write+0x14/0x30 worker_thread+0x87f/0x1570 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? __pfx_try_to_wake_up+0x10/0x10 ? kasan_print_address_stack_frame+0x1f7/0x280 ? __pfx_worker_thread+0x10/0x10 kthread+0x396/0x830 ? __pfx__raw_spin_lock_irq+0x10/0x10 ? __pfx_kthread+0x10/0x10 ? __kasan_check_write+0x14/0x30 ? recalc_sigpending+0x180/0x210 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x3f7/0x610 ? __pfx_ret_from_fork+0x10/0x10 ? __switch_to+0x385/0xda0 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> [ idryomov: replace if statements with ceph_decode_need() for payload_len and result_msg_len ]
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc , < ea080b21092590122c3f971cf588932cdbf47847 (git)
Affected: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc , < edc678e5cd11730a2834b43071d8923f05bc334d (git)
Affected: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc , < 6cee34d6669fe176b4259131adb1a145c939b472 (git)
Affected: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc , < 8bb87547e92dcf0928ed763c60e0ac8d733c3656 (git)
Affected: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc , < ed024d2f4c79c0eb2464df0fb640610ac301f9a0 (git)
Affected: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc , < f9da5c1bbac5c8e33259fe00ed7347438fffa969 (git)
Affected: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc , < 9f9e2297f45fc2d2524eb104c289d69ddef95665 (git)
Affected: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc , < b282c43ed156ae15ea76748fc15cd5c39dc9ab72 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.34
Unaffected: 0 , < 2.6.34 (semver)
Unaffected: 5.10.253 , ≤ 5.10.* (semver)
Unaffected: 5.15.203 , ≤ 5.15.* (semver)
Unaffected: 6.1.167 , ≤ 6.1.* (semver)
Unaffected: 6.6.130 , ≤ 6.6.* (semver)
Unaffected: 6.12.78 , ≤ 6.12.* (semver)
Unaffected: 6.18.19 , ≤ 6.18.* (semver)
Unaffected: 6.19.9 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ceph/auth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ea080b21092590122c3f971cf588932cdbf47847",
              "status": "affected",
              "version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
              "versionType": "git"
            },
            {
              "lessThan": "edc678e5cd11730a2834b43071d8923f05bc334d",
              "status": "affected",
              "version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
              "versionType": "git"
            },
            {
              "lessThan": "6cee34d6669fe176b4259131adb1a145c939b472",
              "status": "affected",
              "version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
              "versionType": "git"
            },
            {
              "lessThan": "8bb87547e92dcf0928ed763c60e0ac8d733c3656",
              "status": "affected",
              "version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
              "versionType": "git"
            },
            {
              "lessThan": "ed024d2f4c79c0eb2464df0fb640610ac301f9a0",
              "status": "affected",
              "version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
              "versionType": "git"
            },
            {
              "lessThan": "f9da5c1bbac5c8e33259fe00ed7347438fffa969",
              "status": "affected",
              "version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
              "versionType": "git"
            },
            {
              "lessThan": "9f9e2297f45fc2d2524eb104c289d69ddef95665",
              "status": "affected",
              "version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
              "versionType": "git"
            },
            {
              "lessThan": "b282c43ed156ae15ea76748fc15cd5c39dc9ab72",
              "status": "affected",
              "version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ceph/auth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.34"
            },
            {
              "lessThan": "2.6.34",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.19",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.9",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()\n\nThis patch fixes an out-of-bounds access in ceph_handle_auth_reply()\nthat can be triggered by a message of type CEPH_MSG_AUTH_REPLY. In\nceph_handle_auth_reply(), the value of the payload_len field of such a\nmessage is stored in a variable of type int. A value greater than\nINT_MAX leads to an integer overflow and is interpreted as a negative\nvalue. This leads to decrementing the pointer address by this value and\nsubsequently accessing it because ceph_decode_need() only checks that\nthe memory access does not exceed the end address of the allocation.\n\nThis patch fixes the issue by changing the data type of payload_len to\nu32. Additionally, the data type of result_msg_len is changed to u32,\nas it is also a variable holding a non-negative length.\n\nAlso, an additional layer of sanity checks is introduced, ensuring that\ndirectly after reading it from the message, payload_len and\nresult_msg_len are not greater than the overall segment length.\n\nBUG: KASAN: slab-out-of-bounds in ceph_handle_auth_reply+0x642/0x7a0 [libceph]\nRead of size 4 at addr ffff88811404df14 by task kworker/20:1/262\n\nCPU: 20 UID: 0 PID: 262 Comm: kworker/20:1 Not tainted 6.19.2 #5 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nWorkqueue: ceph-msgr ceph_con_workfn [libceph]\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x76/0xa0\n print_report+0xd1/0x620\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n ? kasan_complete_mode_report_info+0x72/0x210\n kasan_report+0xe7/0x130\n ? ceph_handle_auth_reply+0x642/0x7a0 [libceph]\n ? ceph_handle_auth_reply+0x642/0x7a0 [libceph]\n __asan_report_load_n_noabort+0xf/0x20\n ceph_handle_auth_reply+0x642/0x7a0 [libceph]\n mon_dispatch+0x973/0x23d0 [libceph]\n ? apparmor_socket_recvmsg+0x6b/0xa0\n ? __pfx_mon_dispatch+0x10/0x10 [libceph]\n ? __kasan_check_write+0x14/0x30i\n ? mutex_unlock+0x7f/0xd0\n ? __pfx_mutex_unlock+0x10/0x10\n ? __pfx_do_recvmsg+0x10/0x10 [libceph]\n ceph_con_process_message+0x1f1/0x650 [libceph]\n process_message+0x1e/0x450 [libceph]\n ceph_con_v2_try_read+0x2e48/0x6c80 [libceph]\n ? __pfx_ceph_con_v2_try_read+0x10/0x10 [libceph]\n ? save_fpregs_to_fpstate+0xb0/0x230\n ? raw_spin_rq_unlock+0x17/0xa0\n ? finish_task_switch.isra.0+0x13b/0x760\n ? __switch_to+0x385/0xda0\n ? __kasan_check_write+0x14/0x30\n ? mutex_lock+0x8d/0xe0\n ? __pfx_mutex_lock+0x10/0x10\n ceph_con_workfn+0x248/0x10c0 [libceph]\n process_one_work+0x629/0xf80\n ? __kasan_check_write+0x14/0x30\n worker_thread+0x87f/0x1570\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n ? __pfx_try_to_wake_up+0x10/0x10\n ? kasan_print_address_stack_frame+0x1f7/0x280\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x396/0x830\n ? __pfx__raw_spin_lock_irq+0x10/0x10\n ? __pfx_kthread+0x10/0x10\n ? __kasan_check_write+0x14/0x30\n ? recalc_sigpending+0x180/0x210\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x3f7/0x610\n ? __pfx_ret_from_fork+0x10/0x10\n ? __switch_to+0x385/0xda0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\n[ idryomov: replace if statements with ceph_decode_need() for\n  payload_len and result_msg_len ]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable `CEPH_MSG_AUTH_REPLY` is parsed from data received over a Ceph messenger TCP connection from a monitor peer. A malicious or compromised monitor, or an attacker in position to impersonate one, can supply the crafted network message remotely.\nAC:L - The trigger is a deterministic malformed length field in a single auth reply, with no race or unusual heap state required to reach the out-of-bounds read. The attacker controls the relevant message contents.\nPR:N - The vulnerable reply is processed by the kernel client from the network peer during monitor/auth session handling, before any attacker-controlled credentials are required on the target. No local account or target privileges are needed.\nUI:N - Once a Ceph client connects or reconnects to the monitor peer, the attacker can send the crafted reply without further victim action. This is server-to-client network input processing.\nS:U - The impact is within the Linux kernel/client security authority. It does not cross a hypervisor, IOMMU, or separate authorization scope boundary.\nC:H - The signed length overflow lets the attacker move the decode pointer before the message buffer and perform an out-of-bounds kernel memory read at an attacker-influenced offset. Although the immediate read is small, it is not confined to a fixed in-object field, so high confidentiality impact is the safer defensible choice.\nI:N - The bug is an out-of-bounds read caused by pointer underflow; the investigated path does not provide an out-of-bounds write or direct memory corruption primitive. The downstream auth handlers reject the inverted buffer range or ignore the payload.\nA:H - The commit includes a KASAN slab-out-of-bounds report in `ceph_handle_auth_reply()`, and attacker-controlled pointer underflow can fault or oops the kernel worker processing the connection. A malicious peer can repeat the malformed reply to disrupt affected clients."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:27:50.423Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ea080b21092590122c3f971cf588932cdbf47847"
        },
        {
          "url": "https://git.kernel.org/stable/c/edc678e5cd11730a2834b43071d8923f05bc334d"
        },
        {
          "url": "https://git.kernel.org/stable/c/6cee34d6669fe176b4259131adb1a145c939b472"
        },
        {
          "url": "https://git.kernel.org/stable/c/8bb87547e92dcf0928ed763c60e0ac8d733c3656"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed024d2f4c79c0eb2464df0fb640610ac301f9a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9da5c1bbac5c8e33259fe00ed7347438fffa969"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f9e2297f45fc2d2524eb104c289d69ddef95665"
        },
        {
          "url": "https://git.kernel.org/stable/c/b282c43ed156ae15ea76748fc15cd5c39dc9ab72"
        }
      ],
      "title": "libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43407",
    "datePublished": "2026-05-08T14:21:46.927Z",
    "dateReserved": "2026-05-01T14:12:56.008Z",
    "dateUpdated": "2026-08-05T12:27:50.423Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43407",
      "date": "2026-09-16",
      "epss": "0.00537",
      "percentile": "0.43926"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43407\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-08T15:16:52.250\",\"lastModified\":\"2026-06-17T10:49:32.290\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nlibceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()\\n\\nThis patch fixes an out-of-bounds access in ceph_handle_auth_reply()\\nthat can be triggered by a message of type CEPH_MSG_AUTH_REPLY. In\\nceph_handle_auth_reply(), the value of the payload_len field of such a\\nmessage is stored in a variable of type int. A value greater than\\nINT_MAX leads to an integer overflow and is interpreted as a negative\\nvalue. This leads to decrementing the pointer address by this value and\\nsubsequently accessing it because ceph_decode_need() only checks that\\nthe memory access does not exceed the end address of the allocation.\\n\\nThis patch fixes the issue by changing the data type of payload_len to\\nu32. Additionally, the data type of result_msg_len is changed to u32,\\nas it is also a variable holding a non-negative length.\\n\\nAlso, an additional layer of sanity checks is introduced, ensuring that\\ndirectly after reading it from the message, payload_len and\\nresult_msg_len are not greater than the overall segment length.\\n\\nBUG: KASAN: slab-out-of-bounds in ceph_handle_auth_reply+0x642/0x7a0 [libceph]\\nRead of size 4 at addr ffff88811404df14 by task kworker/20:1/262\\n\\nCPU: 20 UID: 0 PID: 262 Comm: kworker/20:1 Not tainted 6.19.2 #5 PREEMPT(voluntary)\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\\nWorkqueue: ceph-msgr ceph_con_workfn [libceph]\\nCall Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0x76/0xa0\\n print_report+0xd1/0x620\\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\\n ? kasan_complete_mode_report_info+0x72/0x210\\n kasan_report+0xe7/0x130\\n ? ceph_handle_auth_reply+0x642/0x7a0 [libceph]\\n ? ceph_handle_auth_reply+0x642/0x7a0 [libceph]\\n __asan_report_load_n_noabort+0xf/0x20\\n ceph_handle_auth_reply+0x642/0x7a0 [libceph]\\n mon_dispatch+0x973/0x23d0 [libceph]\\n ? apparmor_socket_recvmsg+0x6b/0xa0\\n ? __pfx_mon_dispatch+0x10/0x10 [libceph]\\n ? __kasan_check_write+0x14/0x30i\\n ? mutex_unlock+0x7f/0xd0\\n ? __pfx_mutex_unlock+0x10/0x10\\n ? __pfx_do_recvmsg+0x10/0x10 [libceph]\\n ceph_con_process_message+0x1f1/0x650 [libceph]\\n process_message+0x1e/0x450 [libceph]\\n ceph_con_v2_try_read+0x2e48/0x6c80 [libceph]\\n ? __pfx_ceph_con_v2_try_read+0x10/0x10 [libceph]\\n ? save_fpregs_to_fpstate+0xb0/0x230\\n ? raw_spin_rq_unlock+0x17/0xa0\\n ? finish_task_switch.isra.0+0x13b/0x760\\n ? __switch_to+0x385/0xda0\\n ? __kasan_check_write+0x14/0x30\\n ? mutex_lock+0x8d/0xe0\\n ? __pfx_mutex_lock+0x10/0x10\\n ceph_con_workfn+0x248/0x10c0 [libceph]\\n process_one_work+0x629/0xf80\\n ? __kasan_check_write+0x14/0x30\\n worker_thread+0x87f/0x1570\\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\\n ? __pfx_try_to_wake_up+0x10/0x10\\n ? kasan_print_address_stack_frame+0x1f7/0x280\\n ? __pfx_worker_thread+0x10/0x10\\n kthread+0x396/0x830\\n ? __pfx__raw_spin_lock_irq+0x10/0x10\\n ? __pfx_kthread+0x10/0x10\\n ? __kasan_check_write+0x14/0x30\\n ? recalc_sigpending+0x180/0x210\\n ? __pfx_kthread+0x10/0x10\\n ret_from_fork+0x3f7/0x610\\n ? __pfx_ret_from_fork+0x10/0x10\\n ? __switch_to+0x385/0xda0\\n ? __pfx_kthread+0x10/0x10\\n ret_from_fork_asm+0x1a/0x30\\n \u003c/TASK\u003e\\n\\n[ idryomov: replace if statements with ceph_decode_need() for\\n  payload_len and result_msg_len ]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ceph/auth.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc\",\"lessThan\":\"ea080b21092590122c3f971cf588932cdbf47847\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc\",\"lessThan\":\"edc678e5cd11730a2834b43071d8923f05bc334d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc\",\"lessThan\":\"6cee34d6669fe176b4259131adb1a145c939b472\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc\",\"lessThan\":\"8bb87547e92dcf0928ed763c60e0ac8d733c3656\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc\",\"lessThan\":\"ed024d2f4c79c0eb2464df0fb640610ac301f9a0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc\",\"lessThan\":\"f9da5c1bbac5c8e33259fe00ed7347438fffa969\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc\",\"lessThan\":\"9f9e2297f45fc2d2524eb104c289d69ddef95665\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc\",\"lessThan\":\"b282c43ed156ae15ea76748fc15cd5c39dc9ab72\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ceph/auth.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.34\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.34\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.253\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.203\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.167\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.130\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.78\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.19\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.9\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.34.1\",\"versionEndExcluding\":\"5.10.253\",\"matchCriteriaId\":\"F8124DB0-E974-47F7-A4CE-1F4CEA46F14B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.203\",\"matchCriteriaId\":\"20DDB3E9-AABF-4107-ADB0-5362AA067045\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.167\",\"matchCriteriaId\":\"2EDC6BAF-B710-4E26-B6AA-D68922EE7B43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.130\",\"matchCriteriaId\":\"C57BB918-DF28-46B3-94F7-144176841267\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.78\",\"matchCriteriaId\":\"28D591F5-B196-4CC9-905C-DC80F116E7A8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.19\",\"matchCriteriaId\":\"D394AC60-6F28-435F-872A-CCDF384B8331\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.9\",\"matchCriteriaId\":\"E825E7C3-FEAC-4FD3-8A81-78D7387948C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.34:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"A3B1BC1D-ED46-4364-A1D9-1FA74182B03A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.34:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"86D3F64C-3F27-43E0-B0D4-62CE1E1F4EFB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.34:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"7927713B-5EB0-41EB-86A9-9935775162E0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.34:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"59037296-3143-4FBB-AFF7-D4FE2C85502F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.34:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"9CA27FD5-7DBF-4C85-80A9-D523B2E4B033\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.34:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"9711E333-A8E7-4F4B-BCFD-2023E889651A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.34:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"E04D3358-973B-42A1-8E08-2E3AE947193C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6cee34d6669fe176b4259131adb1a145c939b472\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8bb87547e92dcf0928ed763c60e0ac8d733c3656\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9f9e2297f45fc2d2524eb104c289d69ddef95665\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b282c43ed156ae15ea76748fc15cd5c39dc9ab72\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ea080b21092590122c3f971cf588932cdbf47847\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ed024d2f4c79c0eb2464df0fb640610ac301f9a0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/edc678e5cd11730a2834b43071d8923f05bc334d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f9da5c1bbac5c8e33259fe00ed7347438fffa969\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-02T19:42:34+00:00",
      "cve": "CVE-2026-43407",
      "id": "CVE-2026-43407",
      "initial_release_date": "2026-05-08T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43407.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T01:17:52Z",
      "cve": "CVE-2026-43407",
      "id": "CVE-2026-43407",
      "initial_release_date": "2026-05-13T03:34:19Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "643",
      "product_status:recommended": "316",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43407",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43407.json",
      "version": "20"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.