Linux libceph: stale authorizer buffer pointer after ticket refresh causes a use-after-free on msgr1 reconnect

Impact

ceph_x_create_authorizer() caches the authorizer buffer pointer and length in struct ceph_auth_handshake, but when a newer service ticket arrives and the rebuilt authorizer no longer fits, the old ceph_buffer is freed while auth->authorizer_buf still points at it. A later msgr1 reconnect queues that freed pointer and the kernel hits a slab use-after-free inside _copy_from_iter() as tcp_sendmsg() copies it. The realistic outcomes are a KASAN-detected crash of the node or freed slab contents being copied onto the wire toward the Ceph cluster; on a GPU node with kernel CephFS or RBD mounts that means an unplanned loss of the node and any resident job. The trigger is ordinary cluster behaviour - ticket rotation followed by a reconnect - rather than something a tenant on the node can steer, so treat this as a stability and information-exposure bug and not as the remote-root the 9.8 AV:N score implies.

Who can reach it

No tenant path. Triggered by Ceph service ticket rotation plus a msgr1 reconnect; influencing the timing requires control of the Ceph monitors or the ability to disrupt the storage network. Clients using msgr2 exclusively are not on the described reconnect path.

What to do

Update to a stable kernel carrying the fix (five backport commits are linked on the record) and reboot each node with a kernel Ceph mount - a mounted client cannot be reloaded in place, so this is a drain and reboot, best batched with the other libceph fixes from the same day. No configuration change avoids it, though clusters that have moved fully to msgr2 are less likely to hit the reconnect path in the meantime.

References

Related entries

• Linux libceph: integer overflow in osdmap decoding defeats the bounds check and reads out of boundsCVE-2026-68158 · Linux kernel libceph (decode_new_up_state_weight, osdmap length arithmetic)Critical
• Linux kernel libceph: unbounded pg_temp length lets a malicious monitor cause a stack out-of-bounds writeCVE-2026-68159 · Linux kernel libceph (OSDMap pg_temp / pg_upmap / pg_upmap_items decode)Critical
• CephFS kernel client (ceph.ko, ceph_handle_caps): The kernel trusts snap_trace_len straight off the wire, so aCVE-2026-68160 · CephFS kernel client (ceph.ko, ceph_handle_caps)Critical
• Linux kernel (net/xfrm): When IPsec crypto offload takes a GSO segment asynchronously, the segment is unlinked from theCVE-2026-68426 · Linux kernel (net/xfrm)Critical
• Linux kernel (net/xfrm): The ESP-in-TCP send path mis-tracked scatter-gather message offsets and socket memory chargesCVE-2026-72041 · Linux kernel (net/xfrm)Critical
• Linux kernel LIO target: unbounded iSCSI TransportID parse in PR OUT reads past the parameter bufferCVE-2026-72084 · Linux kernel LIO SCSI target (PERSISTENT RESERVE OUT TransportID parsing, iSCSI FORMAT CODE 01b)Critical