CVE-2026-43304

Vulnerability

CVE-2026-43304 is a critical vulnerability in the Linux kernel's Ceph filesystem client (libceph). The issue arises in the process_auth_done() function when decoding authentication keys. Previously, the kernel only checked for keys with no material, but did not enforce an upper bound on key length. By defining and enforcing CEPH_MAX_KEY_LEN, the patch ensures that key material fits into a fixed-size buffer, preventing a buffer overflow. [1]

Exploitation

An attacker can exploit this vulnerability by sending a crafted authentication response containing an excessively long key to a vulnerable system running the Ceph client. No authentication is required to trigger the overflow; the attack can be performed remotely over the network. The attacker only needs to be able to send malicious Ceph protocol messages, which typically requires network access to the target host. [1]

Impact

Successful exploitation allows an attacker to overflow the fixed-size key buffer, potentially leading to memory corruption. This can result in arbitrary code execution with kernel privileges, complete system compromise, or denial of service. Given the critical CVSS score of 9.8, the vulnerability is considered easily exploitable and of high severity. [1]

Mitigation

The fix was committed to the Linux kernel stable tree as commit 1b275bd49e58752efb83767a5d1aed41356c5e64. Users are strongly advised to update their kernel to a version containing this patch. No workarounds are known, and the CVE is not listed as exploited in the wild (KEV) as of the publication date. [1]