imPC@ndo IT

Tracker / CVE-2026-46024

CVE-2026-46024

High 7.5

In the Linux kernel, the following vulnerability has been resolved: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() If a message of type CEPH_MSG_AUTH_REPLY contains a zero value for both protocol and result, this is currently not treated as an error. In case of ac->negotiating == true and ac->protocol > 0, this leads to setting ac->protocol = 0 and ac->ops = NULL. Thereafter, the check for ac->protocol != protocol returns false, and init_protocol() is not called. Subsequently, ac->ops->handle_reply() is called, which leads to a null pointer dereference, because ac->ops is still NULL. This patch changes the check for ac->protocol != protocol to !ac->protocol, as this also includes the case when the protocol was set to zero in the message. This causes the message to be treated as containing a bad auth protocol.

Affected products and versions

linux linux_kernel
linux linux_kernel · 2.6.34.1 → 5.15.209
linux linux_kernel · 5.16 → 6.1.175
linux linux_kernel · 6.13 → 6.18.27
linux linux_kernel · 6.19 → 7.0.4
linux linux_kernel · 6.2 → 6.6.140
linux linux_kernel · 6.7 → 6.12.86

Analysis

This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.

References