CVE-2026-43408
Memory Corruption in Ceph Linux Kernel
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ceph | ceph | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's Ceph filesystem code, specifically involving the functions ceph_mdsc_build_path() and ceph_mdsc_free_path_info(). The issue arises because ceph_mdsc_build_path() must be called with a zero-initialized ceph_path_info parameter. If it is not zero-initialized, ceph_mdsc_free_path_info() may crash the system.
Some callers of ceph_mdsc_build_path() did not initialize the ceph_path_info structure properly, leading to random crashes. The problem is that ceph_mdsc_build_path() only initializes the structure on success, but not on error, and all callers call ceph_mdsc_free_path_info() regardless of success or failure. This mismatch can cause kernel crashes and potentially could be exploited to elevate privileges.
How can this vulnerability impact me? :
This vulnerability can cause random crashes in the Linux kernel when using the Ceph filesystem, leading to system instability or denial of service.
Additionally, there is a possibility that this bug could be exploited to elevate privileges, which would allow an attacker to gain higher access rights on the affected system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability may be detected by observing system crashes or kernel warnings related to Ceph operations, especially messages indicating issues with slab cache or invalid memory operations.
Example kernel log messages to look for include warnings such as "virt_to_cache: Object is not a Slab page!", "cache_from_obj: Wrong slab cache", and kernel BUGs at mm/slub.c.
Since the issue involves ceph_mdsc_build_path() and ceph_mdsc_free_path_info() calls, monitoring kernel logs (e.g., using dmesg or journalctl) for these specific error patterns can help detect the vulnerability.
- Use the command: dmesg | grep -i 'ceph\|slab\|kmem_cache_free\|kernel BUG'
- Use journalctl -k | grep -i 'ceph\|slab\|kmem_cache_free\|kernel BUG' to check kernel logs for relevant errors.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is caused by missing zero-initialization of the ceph_path_info structure before calling ceph_mdsc_build_path(), which can lead to crashes.
Immediate mitigation involves updating the Linux kernel to a version where this issue is fixed, ensuring that all calls to ceph_mdsc_build_path() use zero-initialized ceph_path_info parameters.
If updating the kernel is not immediately possible, monitoring for crash symptoms and avoiding workloads that trigger Ceph path operations may reduce the risk of system instability.