CVE-2026-46119

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A slab-out-of-bounds access exists in the libceph module during the processing of authentication messages. When a CEPH MSG AUTH REPLY message contains a positive value in its result field, the ceph handle auth reply() function treats it as an error code. Subsequently, handle auth reply() attempts to send a preallocated CEPH MSG AUTH message, interpreting that positive value as the size of the front segment to be transmitted. If this value exceeds the allocated memory buffer size for the front segment, memory beyond the buffer is accessed and transmitted. This is addressed by treating only negative values in the result field as errors and adding a BUG ON check in the send prepared auth request() function to ensure the len parameter does not exceed front alloc len.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.