PT-2026-39068 · Linux · Linux Kernel

Jann Horn + 1 · Published 2026-05-08 · Updated 2026-06-01 · CVE-2026-43407

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds access exists in the ceph handle auth reply() function within libceph, triggered by a message of type 'CEPH MSG AUTH REPLY'. The issue occurs because the payload len field is stored as an integer; a value exceeding INT MAX causes an integer overflow, resulting in a negative value. This leads to the pointer address being decremented and subsequently accessed, as the ceph decode need() function only verifies that memory access does not exceed the allocation end address.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-43407

OESA-2026-2417

OESA-2026-2418

OESA-2026-2419

Affected Products

Linux Kernel

References · 150

• https://nvd.nist.gov/vuln/detail/CVE-2025-37815 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-21971 · Security Note
• https://git.kernel.org/stable/c/edc678e5cd11730a2834b43071d8923f05bc334d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-39676 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43053 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-38194 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43289 · Security Note
• https://git.kernel.org/stable/c/b282c43ed156ae15ea76748fc15cd5c39dc9ab72 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-23313 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-68283 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-39894 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-39841 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-23138 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-37778 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31447 · Security Note