Linux kernel libceph: signed payload_len in auth replies causes slab out-of-bounds read

Impact

ceph_handle_auth_reply() stored the payload_len field of a CEPH_MSG_AUTH_REPLY in a signed int, so a value above INT_MAX became negative, moved the decode pointer backwards, and read outside the allocation - ceph_decode_need() only validates the upper bound. The reporter reproduced it as a KASAN slab-out-of-bounds read in the ceph-msgr workqueue. This is the kernel Ceph client on the compute node, reached while processing a monitor reply, which means the attack lands before authentication completes. For a GPU operator the exposure is a kernel-context read fault on any node with CephFS or RBD mounted - a crash that kills the jobs on that node - and the code path dates back to 2.6.34, so long-lived image generations are affected.

Who can reach it

A hostile or compromised Ceph monitor, or anyone who can forge or modify monitor traffic on the storage network reaching a node's kernel Ceph client. No credentials on the node are needed; the overflow happens while parsing the auth reply.

What to do

Update the kernel to a stable release where payload_len and result_msg_len are u32 and bounded against the segment length (commits linked in the record), then drain and reboot each node that mounts CephFS or maps RBD. There is no mitigation inside the running kernel; limiting it means keeping the Ceph monitor network unreachable from tenant workloads and using msgr2 secure mode so forged frames are rejected earlier.

References

Related entries

• Linux kernel libceph: positive result field in an auth reply sends kernel memory past the front bufferCVE-2026-46119 · Linux kernel libceph (auth reply result field / __send_prepared_auth_request length)Critical
• Linux kernel libceph: osdmap_decode() under-counts osd_weight, allowing out-of-bounds readsCVE-2026-52958 · Linux kernel libceph (osdmap_decode max_osd bounds check)Critical
• Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.c: Nvmet_auth_reply()CVE-2026-64319 · Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.cCritical
• Linux kernel - NVMe-oF target discovery controller, drivers/nvme/target/discovery.c: The discovery controller validatedCVE-2026-64320 · Linux kernel - NVMe-oF target discovery controller, drivers/nvme/target/discovery.cCritical
• perf tools: out-of-bounds heap read parsing a crafted perf.data CPU indexCVE-2026-80670 · Linux kernel perf tools (machine__resolve() CPU index from perf.data samples)Critical
• Linux NFSD: NFSv2 SETATTR reaches notify_change without a mount write referenceCVE-2026-89697 · Linux kernel NFSD (nfsd_proc_setattr, NFSv2 BOTH_TIME_SET path)Critical