CVE-2026-68156

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in libceph where ceph x create authorizer() caches the iov base and iov len of the authorizer buffer within the ceph auth handshake structure. When ceph x update authorizer() rebuilds the authorizer due to a newer service ticket, ceph x build authorizer() may allocate a new buffer and release the old one via ceph buffer put(). This leaves auth->authorizer buf pointing to freed memory. A subsequent msgr1 reconnect can use this stale pointer, leading to a KASAN slab-use-after-free in the copy from iter() function during the execution of tcp sendmsg() while copying the authorizer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.