CVE-2026-43304
CriticalSummary
A vulnerability in the Linux kernel related to the libceph library has been resolved, concerning key length verification. The new CEPH_MAX_KEY_LEN check ensures that the key material fits into a fixed-size buffer.
Risk Assessment
Insufficient key length verification may lead to buffer overflow, posing a risk of executing malicious code. Organizations should be aware of potential data security threats.
Recommendation
It is recommended to update the Linux kernel to the latest version to benefit from the fixes related to key length verification in the libceph library.
Other vulnerabilities in Linux kernel, libceph
See all- CVE-2026-46024High
A vulnerability has been identified in the Linux kernel within libceph that may lead to a null pointer dereference in the ceph_handle_auth_reply() function. The issue occurs when a CEPH_MSG_AUTH_REPLY message contains zero values for both protocol and result, which is not currently treated as an error.
- CVE-2026-22990High
A vulnerability in the Linux kernel has been resolved in libceph, concerning the overzealous use of BUG_ON in the osdmap_apply_incremental() function. If the osdmap is maliciously corrupted, it should be declared invalid instead of triggering a bug.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: libceph: define and enforce CEPH_MAX_KEY_LEN When decoding the key, verify that the key material would fit into a fixed-size buffer in process_auth_done() and generally has a sane length. The new CEPH_MAX_KEY_LEN check replaces t