CVE-2026-46119: Linux Kernel Privilege Escalation Flaw

CVE-2026-46119 Overview

CVE-2026-46119 is a slab-out-of-bounds access vulnerability in the libceph component of the Linux kernel. The flaw resides in the authentication message processing path, where a corrupted CEPH_MSG_AUTH_REPLY message can cause the kernel to read beyond an allocated buffer when preparing the subsequent CEPH_MSG_AUTH request. A positive value placed in the result field of the reply is later reinterpreted as a front-segment length, leading to an out-of-bounds read and exposure of adjacent kernel memory over the network.

Critical Impact
A malicious or corrupted Ceph authentication reply triggers an out-of-bounds read in ceph_handle_auth_reply(), leaking kernel slab memory contents to the remote peer.

Affected Products

Linux kernel libceph subsystem (multiple stable branches receiving backports)
Systems mounting CephFS or using RBD clients via the in-kernel libceph module
Distributions shipping unpatched stable kernels referenced in the upstream fix commits

Discovery Timeline

2026-05-28 - CVE-2026-46119 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46119

Vulnerability Analysis

The vulnerability lives in the Ceph client authentication handshake inside the kernel. When the client receives a CEPH_MSG_AUTH_REPLY, the ceph_handle_auth_reply() function inspects the result field of the message. The original logic treated any non-zero value as an error code and propagated it back to handle_auth_reply().

The caller then used that return value to size the front segment of a preallocated CEPH_MSG_AUTH outbound message. A positive result value was therefore reinterpreted as a buffer length rather than rejected as malformed. When this length exceeded front_alloc_len, the send path read past the end of the slab allocation, transmitting unrelated kernel heap contents over the network socket. This is an out-of-bounds read [CWE-125] caused by improper validation of an attacker-controlled field.

Root Cause

The root cause is a type and sign confusion in the handling of the result field. The protocol semantics define negative values as errors, but the implementation accepted any non-zero value as an error and re-used that integer in length arithmetic downstream. No bounds check compared the resulting length against front_alloc_len before the message was sent.

Attack Vector

An attacker who can deliver crafted Ceph protocol traffic to a vulnerable client, for example a compromised or spoofed monitor peer, can place a large positive integer in the result field of an AUTH_REPLY message. The client then emits a follow-up AUTH message whose front segment extends beyond the allocated buffer, exfiltrating adjacent slab memory back to the attacker-controlled peer.

The upstream fix narrows the error condition so that only negative result values are treated as errors, while zero and positive values are treated as success. A BUG_ON was added in __send_prepared_auth_request() to compare the len parameter against front_alloc_len, ensuring any future logic flaw aborts before an out-of-bounds send. See the Kernel Security Fix for the implementation.

Detection Methods for CVE-2026-46119

Indicators of Compromise

Unexpected CEPH_MSG_AUTH frames whose front segment length exceeds typical authentication payload sizes observed on the wire.
Kernel logs containing BUG_ON or oops messages originating from __send_prepared_auth_request() after the patch is applied.
Ceph monitor sessions originating from unauthorized or unexpected peer IP addresses.

Detection Strategies

Inspect kernel version strings across Linux fleets and compare them against the patched stable branches listed in the upstream commits.
Audit dmesg and persistent kernel logs for libceph warnings, slab corruption reports, or KASAN findings referencing ceph_handle_auth_reply.
Monitor network telemetry for anomalous Ceph protocol exchanges on ports used by the cluster (typically 3300 and 6789).

Monitoring Recommendations

Enable KASAN on test kernels to catch slab-out-of-bounds events in the libceph path before production rollout.
Forward kernel syslog to a centralized analytics platform and alert on stack traces containing ceph_handle_auth_reply or __send_prepared_auth_request.
Track outbound packet sizes from Ceph clients and flag authentication messages that deviate from baseline distributions.

How to Mitigate CVE-2026-46119

Immediate Actions Required

Update affected Linux kernels to a stable release that includes the upstream libceph fix commits referenced by the NVD entry.
Restrict network reachability of Ceph monitors so that only trusted peers can initiate authentication exchanges with clients.
Verify integrity of monitor hosts to ensure no upstream attacker is positioned to inject crafted AUTH_REPLY messages.

Patch Information

The fix is distributed across multiple stable kernel branches. Apply the patches available in the upstream repositories: Kernel Patch Update, Kernel Commit Changes, Kernel Code Update, Kernel Security Fix, and Kernel Commit Review. The patch changes ceph_handle_auth_reply() to treat only negative result values as errors and adds a BUG_ON(len > front_alloc_len) guard in __send_prepared_auth_request().

Workarounds

Unload the libceph and dependent ceph/rbd modules on hosts that do not require Ceph connectivity until kernels are patched.
Enforce network segmentation and IPsec or mTLS overlays between Ceph clients and monitors to prevent injection of crafted authentication replies.
Use msgr2 with authenticated and encrypted transport configurations to reduce the risk of a spoofed monitor delivering malicious replies.

bash

# Verify running kernel and confirm libceph module status
uname -r
lsmod | grep -E 'libceph|ceph|rbd'

# Temporarily unload Ceph modules on non-Ceph hosts
sudo umount -a -t ceph
sudo modprobe -r rbd ceph libceph