Linux kernel libceph: positive result field in an auth reply sends kernel memory past the front buffer

Impact

A CEPH_MSG_AUTH_REPLY carrying a positive value in its result field had that value treated as an error code and then reused as the front-segment length of the preallocated CEPH_MSG_AUTH reply. If the value exceeds the allocated front buffer, the kernel transmits the memory beyond that buffer to the peer - an outbound kernel memory disclosure, not just a crash. On a GPU node with CephFS or RBD mounted this hands a hostile monitor a channel to read kernel heap contents from the compute host, which is the worst of the four libceph bugs in this batch for confidentiality. The fix treats only negative result values as errors and adds a BUG_ON comparing the send length to front_alloc_len, so an unpatched node that hits this after partial hardening crashes instead.

Who can reach it

A hostile or compromised Ceph monitor, or an attacker who can forge monitor replies on the storage network to a node's kernel Ceph client. No authentication on the node is required - the flaw is in handling the pre-auth reply itself.

What to do

Update the kernel to a stable release carrying the result-field fix (commits in the record) and reboot each node with a kernel Ceph mount; the libceph module is pinned in use while mounts are active, so this is a drain-and-reboot per node. Until then, isolate the Ceph monitor network from tenant-reachable paths and enable msgr2 secure mode so forged replies are dropped before decode. Affected code reaches back to 2.6.34, so check long-lived node images rather than only current ones.

References

Related entries

• Linux kernel libceph: osdmap_decode() under-counts osd_weight, allowing out-of-bounds readsCVE-2026-52958 · Linux kernel libceph (osdmap_decode max_osd bounds check)Critical
• Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.c: Nvmet_auth_reply()CVE-2026-64319 · Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.cCritical
• Linux kernel - NVMe-oF target discovery controller, drivers/nvme/target/discovery.c: The discovery controller validatedCVE-2026-64320 · Linux kernel - NVMe-oF target discovery controller, drivers/nvme/target/discovery.cCritical
• perf tools: out-of-bounds heap read parsing a crafted perf.data CPU indexCVE-2026-80670 · Linux kernel perf tools (machine__resolve() CPU index from perf.data samples)Critical
• Linux NFSD: NFSv2 SETATTR reaches notify_change without a mount write referenceCVE-2026-89697 · Linux kernel NFSD (nfsd_proc_setattr, NFSv2 BOTH_TIME_SET path)Critical
• Linux NFSD: TOCTOU lets a SETATTR truncate an append-only fileCVE-2026-89713 · Linux kernel NFSD (nfsd_setattr ATTR_SIZE truncate permission check)Critical