CVE-2026-22984

In the Linux kernel, a missing bounds check in the libceph component’s handle_auth_done() function allows an out-of-bounds read of kernel memory. The flaw could enable an attacker to read data beyond the intended buffer, potentially exposing sensitive kernel data or causing a kernel crash. This is a classic out-of-bounds read weakness classified as CWE-125.

The vulnerability affects all Linux kernel releases that include the libceph module and have not yet incorporated the patch, including kernel version 6.19 through release candidates rc1–rc4. Any earlier kernels that ship the unpatched libceph component are also potentially impacted. Systems that load libceph to process Ceph authentication are thus the ones that would be affected.

The CVSS score of 9.8 reflects a high severity. The EPSS score of less than 1% indicates a low probability of exploitation at this time, and the vulnerability is not listed in CISA KEV. The attack would need to influence how Ceph authentication payloads are handled, suggesting a local or privileged code path; this inference comes from the requirement to feed crafted payloads to the kernel. No public exploit has been observed, so the current risk is mostly theoretical.