CVE-2026-43408

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43408", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:56.008Z", "datePublished": "2026-05-08T14:21:47.579Z", "dateUpdated": "2026-10-21T12:40:44.899Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:40:44.899Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: add a bunch of missing ceph_path_info initializers\n\nceph_mdsc_build_path() must be called with a zero-initialized\nceph_path_info parameter, or else the following\nceph_mdsc_free_path_info() may crash.\n\nExample crash (on Linux 6.18.12):\n\n virt_to_cache: Object is not a Slab page!\n WARNING: CPU: 184 PID: 2871736 at mm/slub.c:6732 kmem_cache_free+0x316/0x400\n [...]\n Call Trace:\n [...]\n ceph_open+0x13d/0x3e0\n do_dentry_open+0x134/0x480\n vfs_open+0x2a/0xe0\n path_openat+0x9a3/0x1160\n [...]\n cache_from_obj: Wrong slab cache. names_cache but object is from ceph_inode_info\n WARNING: CPU: 184 PID: 2871736 at mm/slub.c:6746 kmem_cache_free+0x2dd/0x400\n [...]\n kernel BUG at mm/slub.c:634!\n Oops: invalid opcode: 0000 [#1] SMP NOPTI\n RIP: 0010:__slab_free+0x1a4/0x350\n\nSome of the ceph_mdsc_build_path() callers had initializers, but\nothers had not, even though they were all added by commit 15f519e9f883\n(\"ceph: fix race condition validating r_parent before applying state\").\nThe ones without initializer are suspectible to random crashes. (I can\nimagine it could even be possible to exploit this bug to elevate\nprivileges.)\n\nUnfortunately, these Ceph functions are undocumented and its semantics\ncan only be derived from the code. I see that ceph_mdsc_build_path()\ninitializes the structure only on success, but not on error.\n\nCalling ceph_mdsc_free_path_info() after a failed\nceph_mdsc_build_path() call does not even make sense, but that's what\nall callers do, and for it to be safe, the structure must be\nzero-initialized. The least intrusive approach to fix this is\ntherefore to add initializers everywhere."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Reachable through local VFS operations on an already-mounted Ceph filesystem, such as open/create, unlink/rmdir, and setattr/truncate/chmod paths. It is not directly reachable from unauthenticated network packets.\nAC:L - An unprivileged user can create or access Ceph paths that make ceph_mdsc_build_path() fail, such as over-PATH_MAX dentry paths, and the faulty free path runs immediately afterward. No race or external timing condition is required.\nPR:L - The attacker needs only ordinary local user access to a Ceph mount with filesystem permissions to operate on relevant files or directories. No real root or kernel capability is required once the filesystem is mounted.\nUI:N - The attacker triggers the vulnerable path directly with their own filesystem syscalls. No separate victim action is required.\nS:U - The corruption occurs inside the local kernel Ceph client and impacts the same kernel security authority. It does not cross a VM, IOMMU, or other separate security scope boundary.\nC:H - The missing initializer can make ceph_mdsc_free_path_info() kfree a stale or attacker-influenced kernel heap pointer, creating heap corruption. Under the required high-severity tie break, this is treated as capable of yielding kernel memory disclosure primitives.\nI:H - The invalid or double free of a path buffer is kernel heap memory corruption and can plausibly be shaped into write/control-flow corruption. Under the required high-severity tie break, integrity impact is High.\nA:H - The fix commit includes real crashes with invalid slab frees and a kernel BUG/Oops in the Ceph open path. A local attacker can repeatedly trigger a kernel crash, causing high availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ceph/debugfs.c", "fs/ceph/dir.c", "fs/ceph/file.c", "fs/ceph/inode.c"], "versions": [{"version": "db378e6f83ec705c6091c65d482d555edc2b0a72", "lessThan": "644b47f0574fd82aeb9d00317eca8d1f2a525c8c", "status": "affected", "versionType": "git"}, {"version": "15f519e9f883b316d86e2bb6b767a023aafd9d83", "lessThan": "8be8911f590813e6f90bc6407ced1b23e50bc5da", "status": "affected", "versionType": "git"}, {"version": "15f519e9f883b316d86e2bb6b767a023aafd9d83", "lessThan": "453df1f4535842bf17ff1885a225e153d7ee3374", "status": "affected", "versionType": "git"}, {"version": "15f519e9f883b316d86e2bb6b767a023aafd9d83", "lessThan": "43323a5934b660afae687e8e4e95ac328615a5c4", "status": "affected", "versionType": "git"}, {"version": "dc5aad078abc416dd3d555c50f5308c16ba918a7", "status": "affected", "versionType": "git"}, {"version": "2bfe45987eb346e299d9f763f9cd05f77011519f", "status": "affected", "versionType": "git"}, {"version": "6.12.48", "lessThan": "6.12.78", "status": "affected", "versionType": "semver"}, {"version": "6.6.160", "lessThan": "6.7", "status": "affected", "versionType": "semver"}, {"version": "6.16.8", "lessThan": "6.17", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ceph/debugfs.c", "fs/ceph/dir.c", "fs/ceph/file.c", "fs/ceph/inode.c"], "versions": [{"version": "6.17", "status": "affected"}, {"version": "0", "lessThan": "6.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.78", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.19", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.9", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.48", "versionEndExcluding": "6.12.78"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.18.19"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.19.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/644b47f0574fd82aeb9d00317eca8d1f2a525c8c"}, {"url": "https://git.kernel.org/stable/c/8be8911f590813e6f90bc6407ced1b23e50bc5da"}, {"url": "https://git.kernel.org/stable/c/453df1f4535842bf17ff1885a225e153d7ee3374"}, {"url": "https://git.kernel.org/stable/c/43323a5934b660afae687e8e4e95ac328615a5c4"}], "title": "ceph: add a bunch of missing ceph_path_info initializers", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43408", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:17:15.370750Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-457", "description": "CWE-457 Use of Uninitialized Variable"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:26:36.369Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43408", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:17:15.370750Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-457", "description": "CWE-457 Use of Uninitialized Variable"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:17:16.599Z"}}], "cna": {"title": "ceph: add a bunch of missing ceph_path_info initializers", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Reachable through local VFS operations on an already-mounted Ceph filesystem, such as open/create, unlink/rmdir, and setattr/truncate/chmod paths. It is not directly reachable from unauthenticated network packets.\nAC:L - An unprivileged user can create or access Ceph paths that make ceph_mdsc_build_path() fail, such as over-PATH_MAX dentry paths, and the faulty free path runs immediately afterward. No race or external timing condition is required.\nPR:L - The attacker needs only ordinary local user access to a Ceph mount with filesystem permissions to operate on relevant files or directories. No real root or kernel capability is required once the filesystem is mounted.\nUI:N - The attacker triggers the vulnerable path directly with their own filesystem syscalls. No separate victim action is required.\nS:U - The corruption occurs inside the local kernel Ceph client and impacts the same kernel security authority. It does not cross a VM, IOMMU, or other separate security scope boundary.\nC:H - The missing initializer can make ceph_mdsc_free_path_info() kfree a stale or attacker-influenced kernel heap pointer, creating heap corruption. Under the required high-severity tie break, this is treated as capable of yielding kernel memory disclosure primitives.\nI:H - The invalid or double free of a path buffer is kernel heap memory corruption and can plausibly be shaped into write/control-flow corruption. Under the required high-severity tie break, integrity impact is High.\nA:H - The fix commit includes real crashes with invalid slab frees and a kernel BUG/Oops in the Ceph open path. A local attacker can repeatedly trigger a kernel crash, causing high availability impact."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "db378e6f83ec705c6091c65d482d555edc2b0a72", "lessThan": "644b47f0574fd82aeb9d00317eca8d1f2a525c8c", "versionType": "git"}, {"status": "affected", "version": "15f519e9f883b316d86e2bb6b767a023aafd9d83", "lessThan": "8be8911f590813e6f90bc6407ced1b23e50bc5da", "versionType": "git"}, {"status": "affected", "version": "15f519e9f883b316d86e2bb6b767a023aafd9d83", "lessThan": "453df1f4535842bf17ff1885a225e153d7ee3374", "versionType": "git"}, {"status": "affected", "version": "15f519e9f883b316d86e2bb6b767a023aafd9d83", "lessThan": "43323a5934b660afae687e8e4e95ac328615a5c4", "versionType": "git"}, {"status": "affected", "version": "dc5aad078abc416dd3d555c50f5308c16ba918a7", "versionType": "git"}, {"status": "affected", "version": "2bfe45987eb346e299d9f763f9cd05f77011519f", "versionType": "git"}, {"status": "affected", "version": "6.12.48", "lessThan": "6.12.78", "versionType": "semver"}, {"status": "affected", "version": "6.6.160", "lessThan": "6.7", "versionType": "semver"}, {"status": "affected", "version": "6.16.8", "lessThan": "6.17", "versionType": "semver"}], "programFiles": ["fs/ceph/debugfs.c", "fs/ceph/dir.c", "fs/ceph/file.c", "fs/ceph/inode.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"status": "unaffected", "version": "0", "lessThan": "6.17", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.78", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.19", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.9", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/ceph/debugfs.c", "fs/ceph/dir.c", "fs/ceph/file.c", "fs/ceph/inode.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/644b47f0574fd82aeb9d00317eca8d1f2a525c8c"}, {"url": "https://git.kernel.org/stable/c/8be8911f590813e6f90bc6407ced1b23e50bc5da"}, {"url": "https://git.kernel.org/stable/c/453df1f4535842bf17ff1885a225e153d7ee3374"}, {"url": "https://git.kernel.org/stable/c/43323a5934b660afae687e8e4e95ac328615a5c4"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: add a bunch of missing ceph_path_info initializers\n\nceph_mdsc_build_path() must be called with a zero-initialized\nceph_path_info parameter, or else the following\nceph_mdsc_free_path_info() may crash.\n\nExample crash (on Linux 6.18.12):\n\n virt_to_cache: Object is not a Slab page!\n WARNING: CPU: 184 PID: 2871736 at mm/slub.c:6732 kmem_cache_free+0x316/0x400\n [...]\n Call Trace:\n [...]\n ceph_open+0x13d/0x3e0\n do_dentry_open+0x134/0x480\n vfs_open+0x2a/0xe0\n path_openat+0x9a3/0x1160\n [...]\n cache_from_obj: Wrong slab cache. names_cache but object is from ceph_inode_info\n WARNING: CPU: 184 PID: 2871736 at mm/slub.c:6746 kmem_cache_free+0x2dd/0x400\n [...]\n kernel BUG at mm/slub.c:634!\n Oops: invalid opcode: 0000 [#1] SMP NOPTI\n RIP: 0010:__slab_free+0x1a4/0x350\n\nSome of the ceph_mdsc_build_path() callers had initializers, but\nothers had not, even though they were all added by commit 15f519e9f883\n(\"ceph: fix race condition validating r_parent before applying state\").\nThe ones without initializer are suspectible to random crashes. (I can\nimagine it could even be possible to exploit this bug to elevate\nprivileges.)\n\nUnfortunately, these Ceph functions are undocumented and its semantics\ncan only be derived from the code. I see that ceph_mdsc_build_path()\ninitializes the structure only on success, but not on error.\n\nCalling ceph_mdsc_free_path_info() after a failed\nceph_mdsc_build_path() call does not even make sense, but that's what\nall callers do, and for it to be safe, the structure must be\nzero-initialized. The least intrusive approach to fix this is\ntherefore to add initializers everywhere."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.78", "versionStartIncluding": "6.12.48"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.19", "versionStartIncluding": "6.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.9", "versionStartIncluding": "6.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "6.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.6.160"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.16.8"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:40:44.899Z"}}}, "cveMetadata": {"cveId": "CVE-2026-43408", "state": "PUBLISHED", "dateUpdated": "2026-10-21T12:40:44.899Z", "dateReserved": "2026-05-01T14:12:56.008Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-05-08T14:21:47.579Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/ceph/debugfs.c", "fs/ceph/dir.c", "fs/ceph/file.c", "fs/ceph/inode.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "644b47f0574fd82aeb9d00317eca8d1f2a525c8c", "status": "affected", "version": "db378e6f83ec705c6091c65d482d555edc2b0a72", "versionType": "git"}, {"lessThan": "8be8911f590813e6f90bc6407ced1b23e50bc5da", "status": "affected", "version": "15f519e9f883b316d86e2bb6b767a023aafd9d83", "versionType": "git"}, {"lessThan": "453df1f4535842bf17ff1885a225e153d7ee3374", "status": "affected", "version": "15f519e9f883b316d86e2bb6b767a023aafd9d83", "versionType": "git"}, {"lessThan": "43323a5934b660afae687e8e4e95ac328615a5c4", "status": "affected", "version": "15f519e9f883b316d86e2bb6b767a023aafd9d83", "versionType": "git"}, {"status": "affected", "version": "dc5aad078abc416dd3d555c50f5308c16ba918a7", "versionType": "git"}, {"status": "affected", "version": "2bfe45987eb346e299d9f763f9cd05f77011519f", "versionType": "git"}, {"lessThan": "6.12.78", "status": "affected", "version": "6.12.48", "versionType": "semver"}, {"lessThan": "6.7", "status": "affected", "version": "6.6.160", "versionType": "semver"}, {"lessThan": "6.17", "status": "affected", "version": "6.16.8", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/ceph/debugfs.c", "fs/ceph/dir.c", "fs/ceph/file.c", "fs/ceph/inode.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"lessThan": "6.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.78", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.19", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6EC06A5F-045A-48FD-8863-E8AB8E92B0BE", "versionEndExcluding": "6.12.78", "versionStartIncluding": "6.12.48", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8C0D11FE-A1CB-4D09-B221-8281514EB44E", "versionEndExcluding": "6.17", "versionStartIncluding": "6.16.8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2B44FFCD-31AB-4CB4-8733-63F887DA5E89", "versionEndExcluding": "6.18.19", "versionStartIncluding": "6.17.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E825E7C3-FEAC-4FD3-8A81-78D7387948C9", "versionEndExcluding": "6.19.9", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:-:*:*:*:*:*:*", "matchCriteriaId": "7CC8B11D-82DC-4958-8DC7-BF5CC829A5E9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc6:*:*:*:*:*:*", "matchCriteriaId": "5A4516A6-C12E-42A4-8C0E-68AEF3264504", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc7:*:*:*:*:*:*", "matchCriteriaId": "3963C3A0-CEA1-4F5C-8011-3A593ABB684D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: add a bunch of missing ceph_path_info initializers\n\nceph_mdsc_build_path() must be called with a zero-initialized\nceph_path_info parameter, or else the following\nceph_mdsc_free_path_info() may crash.\n\nExample crash (on Linux 6.18.12):\n\n virt_to_cache: Object is not a Slab page!\n WARNING: CPU: 184 PID: 2871736 at mm/slub.c:6732 kmem_cache_free+0x316/0x400\n [...]\n Call Trace:\n [...]\n ceph_open+0x13d/0x3e0\n do_dentry_open+0x134/0x480\n vfs_open+0x2a/0xe0\n path_openat+0x9a3/0x1160\n [...]\n cache_from_obj: Wrong slab cache. names_cache but object is from ceph_inode_info\n WARNING: CPU: 184 PID: 2871736 at mm/slub.c:6746 kmem_cache_free+0x2dd/0x400\n [...]\n kernel BUG at mm/slub.c:634!\n Oops: invalid opcode: 0000 [#1] SMP NOPTI\n RIP: 0010:__slab_free+0x1a4/0x350\n\nSome of the ceph_mdsc_build_path() callers had initializers, but\nothers had not, even though they were all added by commit 15f519e9f883\n(\"ceph: fix race condition validating r_parent before applying state\").\nThe ones without initializer are suspectible to random crashes. (I can\nimagine it could even be possible to exploit this bug to elevate\nprivileges.)\n\nUnfortunately, these Ceph functions are undocumented and its semantics\ncan only be derived from the code. I see that ceph_mdsc_build_path()\ninitializes the structure only on success, but not on error.\n\nCalling ceph_mdsc_free_path_info() after a failed\nceph_mdsc_build_path() call does not even make sense, but that's what\nall callers do, and for it to be safe, the structure must be\nzero-initialized. The least intrusive approach to fix this is\ntherefore to add initializers everywhere."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nceph: a\u00f1adir un mont\u00f3n de inicializadores ceph_path_info faltantes\n\nceph_mdsc_build_path() debe ser llamada con un par\u00e1metro ceph_path_info inicializado a cero, o de lo contrario la siguiente ceph_mdsc_free_path_info() podr\u00eda fallar.\n\nEjemplo de fallo (en Linux 6.18.12):\n\n virt_to_cache: \u00a1El objeto no es una p\u00e1gina Slab!\n WARNING: CPU: 184 PID: 2871736 at mm/slub.c:6732 kmem_cache_free+0x316/0x400\n [...]\n Traza de llamada:\n [...]\n ceph_open+0x13d/0x3e0\n do_dentry_open+0x134/0x480\n vfs_open+0x2a/0xe0\n path_openat+0x9a3/0x 1160\n [...]\n cache_from_obj: Cach\u00e9 de slab incorrecta. names_cache pero el objeto es de ceph_inode_info\n WARNING: CPU: 184 PID: 2871736 at mm/slub.c:6746 kmem_cache_free+0x2dd/0x400\n [...]\n \u00a1BUG del kernel en mm/slub.c:634!\n Oops: c\u00f3digo de operaci\u00f3n inv\u00e1lido: 0000 [#1] SMP NOPTI\n RIP: 0010:__slab_free+0x1a4/0x350\n\nAlgunos de los llamadores de ceph_mdsc_build_path() ten\u00edan inicializadores, pero otros no, a pesar de que todos fueron a\u00f1adidos por el commit 15f519e9f883 (\u2019ceph: corregir condici\u00f3n de carrera al validar r_parent antes de aplicar el estado\u2019). Los que no tienen inicializador son susceptibles a fallos aleatorios. (Puedo imaginar que incluso podr\u00eda ser posible exploit este error para elevar privilegios).\n\nDesafortunadamente, estas funciones de Ceph no est\u00e1n documentadas y su sem\u00e1ntica solo puede derivarse del c\u00f3digo. Veo que ceph_mdsc_build_path() inicializa la estructura solo en caso de \u00e9xito, pero no en caso de error.\n\nLlamar a ceph_mdsc_free_path_info() despu\u00e9s de una llamada fallida a ceph_mdsc_build_path() ni siquiera tiene sentido, pero eso es lo que hacen todos los llamadores, y para que sea seguro, la estructura debe ser inicializada a cero. El enfoque menos intrusivo para solucionar esto es, por lo tanto, a\u00f1adir inicializadores en todas partes."}], "id": "CVE-2026-43408", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43408", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:17:15.370750Z", "version": "2.0.3"}}]}, "published": "2026-05-08T15:16:52.397", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/43323a5934b660afae687e8e4e95ac328615a5c4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/453df1f4535842bf17ff1885a225e153d7ee3374"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/644b47f0574fd82aeb9d00317eca8d1f2a525c8c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8be8911f590813e6f90bc6407ced1b23e50bc5da"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-457"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: ceph: add a bunch of missing ceph_path_info initializers", "id": "2468200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468200"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-908", "details": ["A flaw was found in the Ceph file system component of the Linux kernel. This vulnerability arises from the failure to properly initialize a data structure (ceph_path_info) before its use, specifically when the ceph_mdsc_build_path() function is called. This oversight can lead to system instability and crashes, resulting in a Denial of Service (DoS). While not definitively proven, there is a potential for this flaw to be exploited for privilege escalation."], "name": "CVE-2026-43408", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43408\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43408\nhttps://lore.kernel.org/linux-cve-announce/2026050842-CVE-2026-43408-6f0a@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[db378e6f83ec705c6091c65d482d555edc2b0a72,644b47f0574fd82aeb9d00317eca8d1f2a525c8c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15f519e9f883b316d86e2bb6b767a023aafd9d83,8be8911f590813e6f90bc6407ced1b23e50bc5da)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15f519e9f883b316d86e2bb6b767a023aafd9d83,453df1f4535842bf17ff1885a225e153d7ee3374)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15f519e9f883b316d86e2bb6b767a023aafd9d83,43323a5934b660afae687e8e4e95ac328615a5c4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "2bfe45987eb346e299d9f763f9cd05f77011519f"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.78,6.13.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.19,6.19.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.9,6.20.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-08T19:15:14.831813+00:00", "updated": "2026-10-23T02:15:14.695480+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}