GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-23201 (GCVE-0-2026-23201)

Vulnerability from cvelistv5 – Published: 2026-02-14 16:27 – Updated: 2026-09-14 11:58
VLAI
Title
ceph: fix oops due to invalid pointer for kfree() in parse_longname()
Summary
In the Linux kernel, the following vulnerability has been resolved: ceph: fix oops due to invalid pointer for kfree() in parse_longname() This fixes a kernel oops when reading ceph snapshot directories (.snap), for example by simply running `ls /mnt/my_ceph/.snap`. The variable str is guarded by __free(kfree), but advanced by one for skipping the initial '_' in snapshot names. Thus, kfree() is called with an invalid pointer. This patch removes the need for advancing the pointer so kfree() is called with correct memory pointer. Steps to reproduce: 1. Create snapshots on a cephfs volume (I've 63 snaps in my testcase) 2. Add cephfs mount to fstab $ echo "samba-fileserver@.files=/volumes/datapool/stuff/3461082b-ecc9-4e82-8549-3fd2590d3fb6 /mnt/test/stuff ceph acl,noatime,_netdev 0 0" >> /etc/fstab 3. Reboot the system $ systemctl reboot 4. Check if it's really mounted $ mount | grep stuff 5. List snapshots (expected 63 snapshots on my system) $ ls /mnt/test/stuff/.snap Now ls hangs forever and the kernel log shows the oops.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4b9aee707c4580511983a0998547f3b28514e6a6 , < c9a129c82ddf82a50b4f8960d2609714ca2dbd26 (git)
Affected: bb80f7618832d26f7e395f52f82b1dac76223e5f , < 8c9af7339de419819cfc641d551675d38ff99abf (git)
Affected: 101841c38346f4ca41dc1802c867da990ffb32eb , < e258ed369c9e04caa7d2fd49785d753ae4034cb6 (git)
Affected: 101841c38346f4ca41dc1802c867da990ffb32eb , < bc8dedae022ce3058659c3addef3ec4b41d15e00 (git)
Affected: 3145b2b11492d61c512bbc59660bb823bc757f48 (git)
Affected: 493479af8af3ab907f49e99323777d498a4fbd2b (git)
Affected: 6.12.42 , < 6.12.70 (semver)
Affected: 6.15.10 , < 6.16 (semver)
Affected: 6.16.1 , < 6.17 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.17
Unaffected: 0 , < 6.17 (semver)
Unaffected: 6.12.70 , ≤ 6.12.* (semver)
Unaffected: 6.18.10 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/crypto.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c9a129c82ddf82a50b4f8960d2609714ca2dbd26",
              "status": "affected",
              "version": "4b9aee707c4580511983a0998547f3b28514e6a6",
              "versionType": "git"
            },
            {
              "lessThan": "8c9af7339de419819cfc641d551675d38ff99abf",
              "status": "affected",
              "version": "bb80f7618832d26f7e395f52f82b1dac76223e5f",
              "versionType": "git"
            },
            {
              "lessThan": "e258ed369c9e04caa7d2fd49785d753ae4034cb6",
              "status": "affected",
              "version": "101841c38346f4ca41dc1802c867da990ffb32eb",
              "versionType": "git"
            },
            {
              "lessThan": "bc8dedae022ce3058659c3addef3ec4b41d15e00",
              "status": "affected",
              "version": "101841c38346f4ca41dc1802c867da990ffb32eb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3145b2b11492d61c512bbc59660bb823bc757f48",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "493479af8af3ab907f49e99323777d498a4fbd2b",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.70",
              "status": "affected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThan": "6.16",
              "status": "affected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThan": "6.17",
              "status": "affected",
              "version": "6.16.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/crypto.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.70",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.70",
                  "versionStartIncluding": "6.12.42",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.10",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.15.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.16.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix oops due to invalid pointer for kfree() in parse_longname()\n\nThis fixes a kernel oops when reading ceph snapshot directories (.snap),\nfor example by simply running `ls /mnt/my_ceph/.snap`.\n\nThe variable str is guarded by __free(kfree), but advanced by one for\nskipping the initial \u0027_\u0027 in snapshot names. Thus, kfree() is called\nwith an invalid pointer.  This patch removes the need for advancing the\npointer so kfree() is called with correct memory pointer.\n\nSteps to reproduce:\n\n1. Create snapshots on a cephfs volume (I\u0027ve 63 snaps in my testcase)\n\n2. Add cephfs mount to fstab\n$ echo \"samba-fileserver@.files=/volumes/datapool/stuff/3461082b-ecc9-4e82-8549-3fd2590d3fb6      /mnt/test/stuff   ceph     acl,noatime,_netdev    0       0\" \u003e\u003e /etc/fstab\n\n3. Reboot the system\n$ systemctl reboot\n\n4. Check if it\u0027s really mounted\n$ mount | grep stuff\n\n5. List snapshots (expected 63 snapshots on my system)\n$ ls /mnt/test/stuff/.snap\n\nNow ls hangs forever and the kernel log shows the oops."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T11:58:12.875Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c9a129c82ddf82a50b4f8960d2609714ca2dbd26"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c9af7339de419819cfc641d551675d38ff99abf"
        },
        {
          "url": "https://git.kernel.org/stable/c/e258ed369c9e04caa7d2fd49785d753ae4034cb6"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc8dedae022ce3058659c3addef3ec4b41d15e00"
        }
      ],
      "title": "ceph: fix oops due to invalid pointer for kfree() in parse_longname()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23201",
    "datePublished": "2026-02-14T16:27:25.693Z",
    "dateReserved": "2026-01-13T15:37:45.986Z",
    "dateUpdated": "2026-09-14T11:58:12.875Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23201",
      "date": "2026-09-19",
      "epss": "0.00118",
      "percentile": "0.0196"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ceph/crypto.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c9a129c82ddf82a50b4f8960d2609714ca2dbd26",
                    "status": "affected",
                    "version": "4b9aee707c4580511983a0998547f3b28514e6a6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8c9af7339de419819cfc641d551675d38ff99abf",
                    "status": "affected",
                    "version": "bb80f7618832d26f7e395f52f82b1dac76223e5f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e258ed369c9e04caa7d2fd49785d753ae4034cb6",
                    "status": "affected",
                    "version": "101841c38346f4ca41dc1802c867da990ffb32eb",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bc8dedae022ce3058659c3addef3ec4b41d15e00",
                    "status": "affected",
                    "version": "101841c38346f4ca41dc1802c867da990ffb32eb",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "3145b2b11492d61c512bbc59660bb823bc757f48",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "493479af8af3ab907f49e99323777d498a4fbd2b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.12.70",
                    "status": "affected",
                    "version": "6.12.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.16",
                    "status": "affected",
                    "version": "6.15.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.17",
                    "status": "affected",
                    "version": "6.16.1",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ceph/crypto.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.17"
                  },
                  {
                    "lessThan": "6.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.70",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.19",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4E35130D-49A4-4F25-AFAF-52726A775239",
                    "versionEndExcluding": "6.12.70",
                    "versionStartIncluding": "6.12.42",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8E12C24E-0833-48D3-9A8D-574823A693F0",
                    "versionEndExcluding": "6.16",
                    "versionStartIncluding": "6.15.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "496F2923-911F-4FFD-B9A0-4B9D70EBA1C4",
                    "versionEndExcluding": "6.18.10",
                    "versionStartIncluding": "6.16.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*",
                    "matchCriteriaId": "EB5B7DFC-C36B-45D8-922C-877569FDDF43",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix oops due to invalid pointer for kfree() in parse_longname()\n\nThis fixes a kernel oops when reading ceph snapshot directories (.snap),\nfor example by simply running `ls /mnt/my_ceph/.snap`.\n\nThe variable str is guarded by __free(kfree), but advanced by one for\nskipping the initial \u0027_\u0027 in snapshot names. Thus, kfree() is called\nwith an invalid pointer.  This patch removes the need for advancing the\npointer so kfree() is called with correct memory pointer.\n\nSteps to reproduce:\n\n1. Create snapshots on a cephfs volume (I\u0027ve 63 snaps in my testcase)\n\n2. Add cephfs mount to fstab\n$ echo \"samba-fileserver@.files=/volumes/datapool/stuff/3461082b-ecc9-4e82-8549-3fd2590d3fb6      /mnt/test/stuff   ceph     acl,noatime,_netdev    0       0\" \u003e\u003e /etc/fstab\n\n3. Reboot the system\n$ systemctl reboot\n\n4. Check if it\u0027s really mounted\n$ mount | grep stuff\n\n5. List snapshots (expected 63 snapshots on my system)\n$ ls /mnt/test/stuff/.snap\n\nNow ls hangs forever and the kernel log shows the oops."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nceph: corrige un oops debido a un puntero inv\u00e1lido para kfree() en parse_longname()\n\nEsto corrige un oops del kernel al leer directorios de instant\u00e1neas de ceph (.snap), por ejemplo, simplemente ejecutando \u0027ls /mnt/my_ceph/.snap\u0027.\n\nLa variable str est\u00e1 protegida por __free(kfree), pero se avanza en uno para saltar el \u0027_\u0027 inicial en los nombres de las instant\u00e1neas. Por lo tanto, se llama a kfree() con un puntero inv\u00e1lido. Este parche elimina la necesidad de avanzar el puntero para que se llame a kfree() con el puntero de memoria correcto.\n\nPasos para reproducir:\n\n1. Crea instant\u00e1neas en un volumen cephfs (tengo 63 instant\u00e1neas en mi caso de prueba)\n\n2. A\u00f1ade el montaje cephfs a fstab\n$ echo \u0027samba-fileserver@.files=/volumes/datapool/stuff/3461082b-ecc9-4e82-8549-3fd2590d3fb6      /mnt/test/stuff   ceph     acl,noatime,_netdev    0       0\u0027 \u0026gt;\u0026gt; /etc/fstab\n\n3. Reinicia el sistema\n$ systemctl reboot\n\n4. Comprueba si est\u00e1 realmente montado\n$ mount | grep stuff\n\n5. Lista las instant\u00e1neas (se esperan 63 instant\u00e1neas en mi sistema)\n$ ls /mnt/test/stuff/.snap\n\nAhora ls se cuelga indefinidamente y el registro del kernel muestra el oops."
          }
        ],
        "id": "CVE-2026-23201",
        "lastModified": "2026-09-14T12:17:39.287",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2026-02-14T17:15:57.950",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8c9af7339de419819cfc641d551675d38ff99abf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/bc8dedae022ce3058659c3addef3ec4b41d15e00"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c9a129c82ddf82a50b4f8960d2609714ca2dbd26"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e258ed369c9e04caa7d2fd49785d753ae4034cb6"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-476"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T11:36:39+00:00",
      "cve": "CVE-2026-23201",
      "id": "CVE-2026-23201",
      "initial_release_date": "2026-02-14T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ceph: fix oops due to invalid pointer for kfree() in parse_longname()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23201.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T01:37:54Z",
      "cve": "CVE-2026-23201",
      "id": "CVE-2026-23201",
      "initial_release_date": "2026-02-16T00:25:04Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "449",
      "product_status:known_not_affected": "312",
      "product_status:recommended": "280",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-23201",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-23201.json",
      "version": "38"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.