CVE-2026-22984

libceph: prevent potential out-of-bounds reads in handle_auth_done()

State: Published
Severity: 9.8 Critical
Published: Jan 23, 2026
Updated: Oct 19, 2026
Reserved: Jan 13, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

libceph: prevent potential out-of-bounds reads in handle_auth_done()

Perform an explicit bounds check on payload_len to avoid a possible out-of-bounds access in the callout.

[ idryomov: changelog ]

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-125 Out-of-bounds Read

Affected Products

Product	Versions
LinuxLinux	cd1a677cad994021b19665ed476aea63f5d54f31 to before 194cfe2af4d2a1de599d39dad636b47c2f6c2c96Affected cd1a677cad994021b19665ed476aea63f5d54f31 to before 79fe3511db416d2f2edcfd93569807cb02736e5eAffected cd1a677cad994021b19665ed476aea63f5d54f31 to before ef208ea331ef688729f64089b895ed1b49e842e3Affected cd1a677cad994021b19665ed476aea63f5d54f31 to before 2802ef3380fa8c4a08cda51ec1f085b1a712e9e2Affected cd1a677cad994021b19665ed476aea63f5d54f31 to before 2d653bb63d598ae4b096dd678744bdcc34ee89e8Affected cd1a677cad994021b19665ed476aea63f5d54f31 to before 818156caffbf55cb4d368f9c3cac64e458fb49c9Affected
LinuxLinux	5.11Affected before 5.11Not affected 5.15.198 through 5.15.Not affected 6.1.161 through 6.1.Not affected 6.6.121 through 6.6.Not affected 6.12.66 through 6.12.Not affected 6.18.6 through 6.18.*Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

cd1a677cad994021b19665ed476aea63f5d54f31 to before 194cfe2af4d2a1de599d39dad636b47c2f6c2c96Affected
cd1a677cad994021b19665ed476aea63f5d54f31 to before 79fe3511db416d2f2edcfd93569807cb02736e5eAffected
cd1a677cad994021b19665ed476aea63f5d54f31 to before ef208ea331ef688729f64089b895ed1b49e842e3Affected
cd1a677cad994021b19665ed476aea63f5d54f31 to before 2802ef3380fa8c4a08cda51ec1f085b1a712e9e2Affected
cd1a677cad994021b19665ed476aea63f5d54f31 to before 2d653bb63d598ae4b096dd678744bdcc34ee89e8Affected
cd1a677cad994021b19665ed476aea63f5d54f31 to before 818156caffbf55cb4d368f9c3cac64e458fb49c9Affected

LinuxLinux

5.11Affected
before 5.11Not affected
5.15.198 through 5.15.*Not affected
6.1.161 through 6.1.*Not affected
6.6.121 through 6.6.*Not affected
6.12.66 through 6.12.*Not affected
6.18.6 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.