Loading vulnerability…
Out-of-bounds read in Linux kernel libceph handle_auth_done()
CVE-2026-22984 is an out-of-bounds read vulnerability in the Linux kernel's libceph component. The handle_auth_done() function lacks an explicit bounds check on payload_len before a callout, potentially allowing reads beyond the available authentication payload. The flaw may cause information disclosure or kernel instability. The fix validates payload_len before the callout.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Potential impacts include disclosure of kernel memory and denial of service through kernel instability or crashes. A CVSS assessment assigns high confidentiality and availability impacts with no integrity impact. Other assessments differ; arbitrary code execution, privilege escalation, and memory modification are not established by the technical details available.
If you can’t patch tonight, do this now.
Until patched, avoid interactions with untrusted Ceph clusters and restrict Ceph traffic to trusted peers using network segmentation and firewall controls. Where operationally feasible, suspend affected kernel Ceph client usage. These exposure-reduction measures do not replace the kernel fix.
Patch, then assume compromise.
Install a distribution-supported kernel update containing the explicit payload_len bounds check in libceph handle_auth_done(), then reboot into the updated kernel. Fixed releases include Debian bookworm linux 6.1.162-1, Debian trixie linux 6.12.69-1, RHEL 8.10 kernel 4.18.0-553.132.1.el8_10, RHEL 9.4 kernel 5.14.0-427.132.1.el9_4, and RHEL 9.6 kernel 5.14.0-570.120.1.el9_6. Use the applicable security update or a later supported build for the exact distribution and support stream. Custom kernels should incorporate the corresponding upstream fix or backport.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.