CVE-2026-43407 Overview
CVE-2026-43407 is an out-of-bounds memory access vulnerability in the Linux kernel's libceph module. The flaw resides in the ceph_handle_auth_reply() function, which processes messages of type CEPH_MSG_AUTH_REPLY. The function stores the payload_len field in a signed int variable. A value greater than INT_MAX causes an integer overflow, producing a negative value used in pointer arithmetic.
The ceph_decode_need() helper only validates that memory access stays below the end of the allocation. It does not guard against negative offsets, allowing reads outside the allocated buffer. KASAN reports confirm a slab-out-of-bounds read of 4 bytes triggered by the ceph-msgr workqueue.
Critical Impact
A network attacker controlling a malicious Ceph monitor or injecting crafted CEPH_MSG_AUTH_REPLY messages can trigger kernel out-of-bounds reads, leading to information disclosure or denial of service in Ceph-connected Linux hosts.
Affected Products
- Linux kernel libceph module (versions prior to the fix commits)
- Linux distributions shipping vulnerable kernel builds with Ceph client support
- Systems mounting CephFS or RBD volumes using kernel-mode Ceph clients
Discovery Timeline
- 2026-05-08 - CVE-2026-43407 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-43407
Vulnerability Analysis
The vulnerability is an integer overflow leading to an out-of-bounds read [CWE-125, CWE-190]. In ceph_handle_auth_reply(), the payload_len field carried by a CEPH_MSG_AUTH_REPLY message is read from attacker-influenced data and stored in a signed int. When the attacker supplies a value greater than INT_MAX, the variable wraps to a negative number.
The code then uses this negative length to advance a pointer into the message buffer. Because pointer arithmetic with a negative integer decrements the address, the resulting pointer falls before the start of the buffer or outside its bounds. Subsequent reads via ceph_decode_need() succeed because that helper only checks the upper bound of the allocation.
The result is a kernel read of memory adjacent to or before the message buffer. KASAN flags the read as slab-out-of-bounds in ceph_handle_auth_reply+0x642/0x7a0 [libceph] on Linux 6.19.2.
Root Cause
The root cause is the use of a signed integer type for a length field that is semantically unsigned, combined with insufficient sanity checks against the enclosing segment length. The upstream fix changes payload_len and result_msg_len to u32. It also adds explicit checks that both fields do not exceed the overall segment length before any pointer arithmetic occurs.
Attack Vector
The attack vector is network-based with no privileges or user interaction required. An attacker who can deliver crafted Ceph monitor traffic to a vulnerable client, for example through a compromised monitor, a man-in-the-middle on the cluster network, or a hostile cluster the victim connects to, can trigger the out-of-bounds access. Exploitation requires only that the target host runs a kernel-mode Ceph client and processes the malicious CEPH_MSG_AUTH_REPLY message.
The vulnerability manifests when payload_len decodes to a value greater than INT_MAX. The signed variable becomes negative, the pointer is decremented, and the subsequent read accesses memory outside the intended allocation. See the upstream commits listed under references for the exact patch hunks, including commit 6cee34d and commit ed024d2.
Detection Methods for CVE-2026-43407
Indicators of Compromise
- KASAN reports referencing slab-out-of-bounds in ceph_handle_auth_reply in kernel logs or dmesg output.
- Unexpected kernel panics or ceph-msgr workqueue crashes on hosts mounting Ceph resources.
- Anomalous CEPH_MSG_AUTH_REPLY messages with abnormally large declared payload lengths captured on the cluster network.
Detection Strategies
- Monitor kernel ring buffers for KASAN or oops traces involving libceph and ceph_con_v2_try_read.
- Inspect Ceph monitor traffic for malformed authentication replies where the encoded payload_len exceeds the segment length.
- Compare deployed kernel build identifiers against the fixed stable branches referenced in the upstream commits.
Monitoring Recommendations
- Forward kernel logs from CephFS and RBD client hosts to a centralized log platform and alert on libceph fault signatures.
- Track connections from Ceph clients to unexpected monitor endpoints outside the approved cluster IP ranges.
- Baseline normal Ceph authentication message sizes and alert on outliers consistent with overflow attempts.
How to Mitigate CVE-2026-43407
Immediate Actions Required
- Update affected systems to a Linux kernel build that includes the upstream libceph fixes for ceph_handle_auth_reply().
- Restrict network reachability of Ceph client hosts so they communicate only with trusted monitors over isolated cluster networks.
- Audit all hosts using kernel-mode CephFS or RBD mounts and prioritize patching for internet-exposed or multi-tenant systems.
Patch Information
The issue is resolved in upstream stable kernels through multiple backport commits. Apply the kernel update containing one of the following commits: 6cee34d, 8bb8754, 9f9e229, b282c43, ea080b2, ed024d2, edc678e, or f9da5c1. The patches change payload_len and result_msg_len to u32 and add segment-length sanity checks.
Workarounds
- Where patching is delayed, prefer userspace Ceph clients such as rbd-nbd or FUSE-based CephFS instead of the kernel client.
- Enforce strict network segmentation between Ceph monitors and client workloads using firewalls or VLAN isolation.
- Require authenticated and encrypted Ceph messenger v2 connections and reject untrusted monitor endpoints at the network layer.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
