CVE-2026-46024 - Vulnerability Details

- libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()

Description

In the Linux kernel, the following vulnerability has been resolved:

libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()

If a message of type CEPH_MSG_AUTH_REPLY contains a zero value for both
protocol and result, this is currently not treated as an error. In case
of ac->negotiating == true and ac->protocol > 0, this leads to setting
ac->protocol = 0 and ac->ops = NULL. Thereafter, the check for
ac->protocol != protocol returns false, and init_protocol() is not
called. Subsequently, ac->ops->handle_reply() is called, which leads to
a null pointer dereference, because ac->ops is still NULL.

This patch changes the check for ac->protocol != protocol to
!ac->protocol, as this also includes the case when the protocol was set
to zero in the message. This causes the message to be treated as
containing a bad auth protocol.

Published: 2026-05-27

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A null‑pointer dereference (CWE-1287) occurs in the Linux kernel’s Ceph client stack when a CEPH_MSG_AUTH_REPLY message contains zero values for both protocol and result during an active negotiation. The code erroneously clears the protocol, sets ops to NULL, skips protocol initialization, and later calls ac->ops->handle_reply(), leading to a kernel crash. This flaw is an incorrect security check that, when triggered, results in a denial of service caused by a kernel panic.

Affected Systems

The flaw affects Linux kernel variants that include the Ceph client subsystem. No specific kernel version is listed, so any release shipping the vulnerable code path prior to the patch may be impacted. Generic distributions with the default stock kernel are therefore potentially exposed.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity for this kernel null‑pointer dereference. The EPSS score is < 1%, showing a very low exploitation probability, and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an attacker can trigger the flaw by sending a crafted CEPH_MSG_AUTH_REPLY message over the network from a Ceph client or manager. The risk remains significant until the patch is applied, as it can lead to an immediate kernel crash.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc`	affected	< 9ded62c302c0342efdb5eda3bf6e75720caad0df
`4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc`	affected	< f101271fcf55d7eacfefd610b51ec65f46ba8118
`4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc`	affected	< 4b2738b93edad661178340239de657d876b73d3d
`4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc`	affected	< 927e4bd5692f2a4901808822981fb2c8d4456548
`4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc`	affected	< 016bc663657366d386993f63eb31072eb45a2b77
`4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc`	affected	< 8f2be7285941a33a9f72579a23b96392f83c758e
`4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc`	affected	< 5199c125d25aeae8615c4fc31652cc0fe624338e

Linux

affected

Version	Status	Constraints
`2.6.34`	affected	—
`0`	unaffected	< 2.6.34
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.140`	unaffected	≤ 6.6.*
`6.12.86`	unaffected	≤ 6.12.*
`6.18.27`	unaffected	≤ 6.18.*
`7.0.4`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:2.6.34:-::::::
	cpe:2.3:o:linux:linux_kernel:2.6.34:rc2::::::
	cpe:2.3:o:linux:linux_kernel:2.6.34:rc3::::::
	cpe:2.3:o:linux:linux_kernel:2.6.34:rc4::::::
	cpe:2.3:o:linux:linux_kernel:2.6.34:rc5::::::
	cpe:2.3:o:linux:linux_kernel:2.6.34:rc6::::::
	cpe:2.3:o:linux:linux_kernel:2.6.34:rc7::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4b2738b93edad661178340239de657d876b73d3d)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,927e4bd5692f2a4901808822981fb2c8d4456548)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,016bc663657366d386993f63eb31072eb45a2b77)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,8f2be7285941a33a9f72579a23b96392f83c758e)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,5199c125d25aeae8615c4fc31652cc0fe624338e)`	affected	code_commit	—
`[0,6.6.140)`	affected	semver	—
`[0,6.12.86)`	affected	semver	—
`[0,6.18.27)`	affected	semver	—
`[0,7.0.4)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6.6.140,6.7.0)`	unaffected	semver	—
`[6.12.86,6.13.0)`	unaffected	semver	—
`[6.18.27,6.19.0)`	unaffected	semver	—
`[7.0.4,7.1.0)`	unaffected	semver	—
`[7.1-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a recent release that includes the patch (commit 016bc663 or later).
If a kernel update cannot be applied immediately, block or limit Ceph client traffic from untrusted hosts using firewall rules or network segmentation to prevent the crafted authentication reply messages.
Monitor system logs, dmesg, and kernel dumps for signs of panics or oopses related to Ceph authentication and apply the patch as soon as possible.

Generated by OpenCVE AI on May 30, 2026 at 12:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00496.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/016bc663657366d386993f63eb31072eb45a2b77
https://git.kernel.org/stable/c/4b2738b93edad661178340239de657d876b73d3d
https://git.kernel.org/stable/c/5199c125d25aeae8615c4fc31652cc0fe624338e
https://git.kernel.org/stable/c/8f2be7285941a33a9f72579a23b96392f83c758e
https://git.kernel.org/stable/c/927e4bd5692f2a4901808822981fb2c8d4456548
https://git.kernel.org/stable/c/9ded62c302c0342efdb5eda3bf6e75720caad0df
https://git.kernel.org/stable/c/f101271fcf55d7eacfefd610b51ec65f46ba8118
https://lore.kernel.org/linux-cve-announce/2026052747-CVE-2026-46024-1d35@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-46024
https://www.cve.org/CVERecord?id=CVE-2026-46024

History

Tue, 16 Jun 2026 16:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
CPEs		cpe:2.3:o:linux:linux_kernel:2.6.34:-:::::: cpe:2.3:o:linux:linux_kernel:2.6.34:rc2:::::: cpe:2.3:o:linux:linux_kernel:2.6.34:rc3:::::: cpe:2.3:o:linux:linux_kernel:2.6.34:rc4:::::: cpe:2.3:o:linux:linux_kernel:2.6.34:rc5:::::: cpe:2.3:o:linux:linux_kernel:2.6.34:rc6:::::: cpe:2.3:o:linux:linux_kernel:2.6.34:rc7::::::

Mon, 01 Jun 2026 17:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/9ded62c302c0342efdb5eda3bf6e75720caad0df https://git.kernel.org/stable/c/f101271fcf55d7eacfefd610b51ec65f46ba8118

Sat, 30 May 2026 11:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Thu, 28 May 2026 04:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-476

Thu, 28 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1287
References		https://lore.kernel.org/linux-cve-announce/2026052747-CVE-2026-46024-1d35@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-46024 https://www.cve.org/CVERecord?id=CVE-2026-46024
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 27 May 2026 20:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Wed, 27 May 2026 14:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() If a message of type CEPH_MSG_AUTH_REPLY contains a zero value for both protocol and result, this is currently not treated as an error. In case of ac->negotiating == true and ac->protocol > 0, this leads to setting ac->protocol = 0 and ac->ops = NULL. Thereafter, the check for ac->protocol != protocol returns false, and init_protocol() is not called. Subsequently, ac->ops->handle_reply() is called, which leads to a null pointer dereference, because ac->ops is still NULL. This patch changes the check for ac->protocol != protocol to !ac->protocol, as this also includes the case when the protocol was set to zero in the message. This causes the message to be treated as containing a bad auth protocol.
Title		libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/016bc663657366d386993f63eb31072eb45a2b77 https://git.kernel.org/stable/c/4b2738b93edad661178340239de657d876b73d3d https://git.kernel.org/stable/c/5199c125d25aeae8615c4fc31652cc0fe624338e https://git.kernel.org/stable/c/8f2be7285941a33a9f72579a23b96392f83c758e https://git.kernel.org/stable/c/927e4bd5692f2a4901808822981fb2c8d4456548

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-27T12:56:29.932Z

Updated: 2026-06-14T17:48:45.491Z

Reserved: 2026-05-13T15:03:33.093Z

Link: CVE-2026-46024

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-05-27T14:17:20.890

Modified: 2026-06-16T15:55:09.843

Link: CVE-2026-46024

Redhat

Severity : Moderate

Publid Date: 2026-05-27T00:00:00Z

Links: CVE-2026-46024 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-30T12:45:23Z

Weaknesses

CWE-1287
Improper Validation of Specified Type of Input
CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object