libceph: Fix slab-out-of-bounds access in auth message processing_CVE-2026-46119

9.1 / 10

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Description

In the Linux kernel, the following vulnerability has been resolved:

libceph: Fix slab-out-of-bounds access in auth message processing

If a (potentially corrupted) message of type CEPH_MSG_AUTH_REPLY
contains a positive value in its result field, it is treated as an
error code by ceph_handle_auth_reply() and returned to
handle_auth_reply(). Thereafter, an attempt is made to send the
preallocated message of type CEPH_MSG_AUTH, where the returned value is
interpreted as the size of the front segment to send. If the result
value in the message is greater than the size of the memory buffer
allocated for the front segment, an out-of-bounds access occurs, and
the content of the memory region beyond this buffer is sent out.

This patch fixes the issue by treating only negative values in the
result field as errors. Positive values are therefore treated as success
in the same way as a zero value. Additionally, a BUG_ON is added to
__send_prepared_auth_request() comparing the len parameter to
front_alloc_len to prevent sending the message if it exceeds the bounds
of the allocation and to make it easier to catch any logic flaws leading
to this.

Basic Information

ID CVE-2026-46119

Source Linux

Published May 28, 2026 at 09:35

Modified May 30, 2026 at 10:47

Affected Product

Vendor Linux

Product Linux

Version 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc

Affected Versions Linux Linux 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc
Linux Linux 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc
Linux Linux 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc
Linux Linux 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc
Linux Linux 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc
Linux Linux 2.6.34

References

{
    "lastseen": "",
    "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Fix slab-out-of-bounds access in auth message processing\n\nIf a (potentially corrupted) message of type CEPH_MSG_AUTH_REPLY\ncontains a positive value in its result field, it is treated as an\nerror code by ceph_handle_auth_reply() and returned to\nhandle_auth_reply(). Thereafter, an attempt is made to send the\npreallocated message of type CEPH_MSG_AUTH, where the returned value is\ninterpreted as the size of the front segment to send. If the result\nvalue in the message is greater than the size of the memory buffer\nallocated for the front segment, an out-of-bounds access occurs, and\nthe content of the memory region beyond this buffer is sent out.\n\nThis patch fixes the issue by treating only negative values in the\nresult field as errors. Positive values are therefore treated as success\nin the same way as a zero value. Additionally, a BUG_ON is added to\n__send_prepared_auth_request() comparing the len parameter to\nfront_alloc_len to prevent sending the message if it exceeds the bounds\nof the allocation and to make it easier to catch any logic flaws leading\nto this.",
    "published": "2026-05-28T09:35:34.543Z",
    "modified": "2026-05-30T10:47:56.938Z",
    "type": "cve",
    "title": "libceph: Fix slab-out-of-bounds access in auth message processing",
    "source": "Linux",
    "references": "https://git.kernel.org/stable/c/2ae0afd98432536562fa8261538ae795446f0589\nhttps://git.kernel.org/stable/c/408e85ee708b6aa03eeb0220ffa0915f4d407181\nhttps://git.kernel.org/stable/c/b7df9fbd4869fdfe09a3f501ffd228486521e062\nhttps://git.kernel.org/stable/c/8517b6c8d2c759918ba0058cb6c7e14d59643202\nhttps://git.kernel.org/stable/c/1c439de70b1c3eb3c6bffa8245c16b9fc318f114",
    "id": "CVE-2026-46119",
    "bulletinFamily": "",
    "cwe": null,
    "cvelist": null,
    "sourceData": "Linux Linux 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc\nLinux Linux 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc\nLinux Linux 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc\nLinux Linux 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc\nLinux Linux 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc\nLinux Linux 2.6.34",
    "sourceHref": "",
    "cvss": {
        "score": 9.1,
        "severity": "CRITICAL",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Linux",
    "version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
    "vendor": "Linux",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}

Description

Basic Information

Affected Product

References

💭 Join the Security Discussion ❌ Cancel Reply