CVE-2026-43406

libceph: prevent potential out-of-bounds reads in process_message_header()

State: Published
Severity: 9.1 Critical
Published: May 8, 2026
Updated: Oct 19, 2026
Reserved: May 1, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

libceph: prevent potential out-of-bounds reads in process_message_header()

If the message frame is (maliciously) corrupted in a way that the length of the control segment ends up being less than the size of the message header or a different frame is made to look like a message frame, out-of-bounds reads may ensue in process_message_header().

Perform an explicit bounds check before decoding the message header.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

CWE-125 Out-of-bounds Read

Affected Products

Product	Versions
LinuxLinux	cd1a677cad994021b19665ed476aea63f5d54f31 to before 76ccf21a12c5f6d6790bc32c7da82446d877b2f4Affected cd1a677cad994021b19665ed476aea63f5d54f31 to before 75582aaa580c11aed4c7731cad6b068b700e7efbAffected cd1a677cad994021b19665ed476aea63f5d54f31 to before 50156622eb0888e62541d715a98584480a1bc7cbAffected cd1a677cad994021b19665ed476aea63f5d54f31 to before dbd857a9e1e33ea71eaf3e211877027e533770d1Affected cd1a677cad994021b19665ed476aea63f5d54f31 to before 69fe5af33fa3806f398d21c081d73c66e5523bc2Affected cd1a677cad994021b19665ed476aea63f5d54f31 to before 035867ae6f18df0aeedb2a57a5b74091bd4e3fe8Affected cd1a677cad994021b19665ed476aea63f5d54f31 to before 69fb5d91bba44ecf7eb80530b85fa4fb028921d5Affected
LinuxLinux	5.11Affected before 5.11Not affected 5.15.203 through 5.15.Not affected 6.1.167 through 6.1.Not affected 6.6.130 through 6.6.Not affected 6.12.78 through 6.12.Not affected 6.18.19 through 6.18.Not affected 6.19.9 through 6.19.Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

cd1a677cad994021b19665ed476aea63f5d54f31 to before 76ccf21a12c5f6d6790bc32c7da82446d877b2f4Affected
cd1a677cad994021b19665ed476aea63f5d54f31 to before 75582aaa580c11aed4c7731cad6b068b700e7efbAffected
cd1a677cad994021b19665ed476aea63f5d54f31 to before 50156622eb0888e62541d715a98584480a1bc7cbAffected
cd1a677cad994021b19665ed476aea63f5d54f31 to before dbd857a9e1e33ea71eaf3e211877027e533770d1Affected
cd1a677cad994021b19665ed476aea63f5d54f31 to before 69fe5af33fa3806f398d21c081d73c66e5523bc2Affected
cd1a677cad994021b19665ed476aea63f5d54f31 to before 035867ae6f18df0aeedb2a57a5b74091bd4e3fe8Affected
cd1a677cad994021b19665ed476aea63f5d54f31 to before 69fb5d91bba44ecf7eb80530b85fa4fb028921d5Affected

LinuxLinux

5.11Affected
before 5.11Not affected
5.15.203 through 5.15.*Not affected
6.1.167 through 6.1.*Not affected
6.6.130 through 6.6.*Not affected
6.12.78 through 6.12.*Not affected
6.18.19 through 6.18.*Not affected
6.19.9 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.