PT-2026-38946 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-05-26 · CVE-2026-43304

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in libceph where the system fails to properly verify the length of key material during decoding. Specifically, the process auth done() function does not ensure that the key material fits within a fixed-size buffer or possesses a reasonable length. This is addressed by implementing and enforcing CEPH MAX KEY LEN to replace an insufficient check that only identified keys with no material.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-43304

Affected Products

Linux Kernel

References · 21

• https://git.kernel.org/stable/c/c1a0f5f1e5e7e98c36a362ec3d1fcfd9932931ed · Patch
• https://cve.org/CVERecord?id=CVE-2026-43304 · Security Note
• https://ubuntu.com/security/CVE-2026-43304 · Vendor Advisory
• https://git.kernel.org/stable/c/d82467c07b03a27c3c5469b62bb3b726305a80bb · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43304 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-43304 · Vendor Advisory
• https://git.kernel.org/stable/c/6405e8c680974bb74e2c98d5249fb52c7b12a6c6 · Patch
• https://git.kernel.org/stable/c/ac431d597a9bdfc2ba6b314813f29a6ef2b4a3bf · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-43304 · Vendor Advisory
• https://git.kernel.org/stable/c/e1dc45d97975f9db65694d234fbddf1915176e16 · Patch
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-43304 · Vendor Advisory
• https://git.kernel.org/stable/c/8d745d38c88ecbed95f6b2b39857bf89f35a3244 · Patch
• https://git.kernel.org/stable/c/1b275bd49e58752efb83767a5d1aed41356c5e64 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43304 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43304 · Vendor Advisory