Buffer Overflow in Linux Kernel Ceph

Publication date: 2026-05-08

Last updated on: 2026-05-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: libceph: define and enforce CEPH_MAX_KEY_LEN When decoding the key, verify that the key material would fit into a fixed-size buffer in process_auth_done() and generally has a sane length. The new CEPH_MAX_KEY_LEN check replaces the existing check for a key with no key material which is a) not universal since CEPH_CRYPTO_NONE has to be excluded and b) doesn't provide much value since a smaller than needed key is just as invalid as no key -- this has to be handled elsewhere anyway.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-08

Last Modified

2026-05-11

Generated

2026-07-09

AI Q&A

2026-05-08

EPSS Evaluated

2026-07-08

NVD

CVE-2026-43304

EUVD

EUVD-2026-28574

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel's libceph component relates to how key material is handled during authentication. Previously, the system only checked if a key had no material, which was insufficient because some keys (like CEPH_CRYPTO_NONE) needed to be excluded and smaller-than-needed keys were not properly validated. The fix introduces a defined maximum key length (CEPH_MAX_KEY_LEN) and enforces that the key material fits into a fixed-size buffer and has a reasonable length during the decoding process in process_auth_done(). This prevents invalid or improperly sized keys from being accepted.

Impact Analysis

If this vulnerability were exploited, it could allow invalid or improperly sized keys to be processed, potentially leading to authentication issues or buffer overflows. This could compromise the security of the Ceph storage system by allowing unauthorized access or causing instability in the kernel module handling authentication.

Hi! I’m here to help you understand CVE-2026-43304. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70