CVE-2026-46119

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46119", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.098Z", "datePublished": "2026-05-28T09:35:34.543Z", "dateUpdated": "2026-10-19T19:26:44.844Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:29:50.601Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Fix slab-out-of-bounds access in auth message processing\n\nIf a (potentially corrupted) message of type CEPH_MSG_AUTH_REPLY\ncontains a positive value in its result field, it is treated as an\nerror code by ceph_handle_auth_reply() and returned to\nhandle_auth_reply(). Thereafter, an attempt is made to send the\npreallocated message of type CEPH_MSG_AUTH, where the returned value is\ninterpreted as the size of the front segment to send. If the result\nvalue in the message is greater than the size of the memory buffer\nallocated for the front segment, an out-of-bounds access occurs, and\nthe content of the memory region beyond this buffer is sent out.\n\nThis patch fixes the issue by treating only negative values in the\nresult field as errors. Positive values are therefore treated as success\nin the same way as a zero value. Additionally, a BUG_ON is added to\n__send_prepared_auth_request() comparing the len parameter to\nfront_alloc_len to prevent sending the message if it exceeds the bounds\nof the allocation and to make it easier to catch any logic flaws leading\nto this."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is in libceph's in-kernel Ceph client (CephFS/RBD), triggered by processing a CEPH_MSG_AUTH_REPLY received over TCP from a Ceph monitor; a malicious monitor or network MITM supplies the malicious data, making it remotely exploitable.\nAC:L - The attacker fully controls the s32 `result` field in the reply and can reliably set it above 4096; no race or specific uncontrollable memory layout is required to trigger the out-of-bounds read.\nPR:N - The vulnerable code runs during the msgr1 auth handshake, before the peer is authenticated and over an unencrypted channel, so a malicious/MITM monitor needs no credentials on the victim system.\nUI:N - Once a Ceph mount/RBD map exists, the client connects and re-authenticates to monitors automatically (including on connection faults), so no per-exploit victim action is required.\nS:U - The out-of-bounds read and resulting crash occur entirely within the kernel's own security authority with no crossing of a security boundary.\nC:H - Kernel heap memory beyond the 4096-byte front buffer (up to ~2GB) is read and transmitted over the network to the attacker, an unbounded information disclosure that can leak pointers, keys, and other message data.\nI:N - The attacker-controlled value only sets a length field used to read and send data; no kernel memory is written or corrupted and there is no control-flow hijack primitive.\nA:H - Setting `result` to a large positive value makes the send path read past mapped memory, causing a kernel oops/crash."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ceph/auth.c", "net/ceph/mon_client.c"], "versions": [{"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc", "lessThan": "c2374b92c729d0388a538b3cde7b3e3b5e55ef39", "status": "affected", "versionType": "git"}, {"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc", "lessThan": "38fdf04c602d52c42c67fc1617211492753b7e8b", "status": "affected", "versionType": "git"}, {"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc", "lessThan": "2ae0afd98432536562fa8261538ae795446f0589", "status": "affected", "versionType": "git"}, {"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc", "lessThan": "408e85ee708b6aa03eeb0220ffa0915f4d407181", "status": "affected", "versionType": "git"}, {"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc", "lessThan": "b7df9fbd4869fdfe09a3f501ffd228486521e062", "status": "affected", "versionType": "git"}, {"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc", "lessThan": "8517b6c8d2c759918ba0058cb6c7e14d59643202", "status": "affected", "versionType": "git"}, {"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc", "lessThan": "1c439de70b1c3eb3c6bffa8245c16b9fc318f114", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ceph/auth.c", "net/ceph/mon_client.c"], "versions": [{"version": "2.6.34", "status": "affected"}, {"version": "0", "lessThan": "2.6.34", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.140", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.88", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.30", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.7", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "6.6.140"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "6.12.88"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "6.18.30"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "7.0.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c2374b92c729d0388a538b3cde7b3e3b5e55ef39"}, {"url": "https://git.kernel.org/stable/c/38fdf04c602d52c42c67fc1617211492753b7e8b"}, {"url": "https://git.kernel.org/stable/c/2ae0afd98432536562fa8261538ae795446f0589"}, {"url": "https://git.kernel.org/stable/c/408e85ee708b6aa03eeb0220ffa0915f4d407181"}, {"url": "https://git.kernel.org/stable/c/b7df9fbd4869fdfe09a3f501ffd228486521e062"}, {"url": "https://git.kernel.org/stable/c/8517b6c8d2c759918ba0058cb6c7e14d59643202"}, {"url": "https://git.kernel.org/stable/c/1c439de70b1c3eb3c6bffa8245c16b9fc318f114"}], "title": "libceph: Fix slab-out-of-bounds access in auth message processing", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46119", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:19:58.794269Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:26:44.844Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46119", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.098Z", "datePublished": "2026-05-28T09:35:34.543Z", "dateUpdated": "2026-10-16T15:20:52.160Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:29:50.601Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Fix slab-out-of-bounds access in auth message processing\n\nIf a (potentially corrupted) message of type CEPH_MSG_AUTH_REPLY\ncontains a positive value in its result field, it is treated as an\nerror code by ceph_handle_auth_reply() and returned to\nhandle_auth_reply(). Thereafter, an attempt is made to send the\npreallocated message of type CEPH_MSG_AUTH, where the returned value is\ninterpreted as the size of the front segment to send. If the result\nvalue in the message is greater than the size of the memory buffer\nallocated for the front segment, an out-of-bounds access occurs, and\nthe content of the memory region beyond this buffer is sent out.\n\nThis patch fixes the issue by treating only negative values in the\nresult field as errors. Positive values are therefore treated as success\nin the same way as a zero value. Additionally, a BUG_ON is added to\n__send_prepared_auth_request() comparing the len parameter to\nfront_alloc_len to prevent sending the message if it exceeds the bounds\nof the allocation and to make it easier to catch any logic flaws leading\nto this."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is in libceph's in-kernel Ceph client (CephFS/RBD), triggered by processing a CEPH_MSG_AUTH_REPLY received over TCP from a Ceph monitor; a malicious monitor or network MITM supplies the malicious data, making it remotely exploitable.\nAC:L - The attacker fully controls the s32 `result` field in the reply and can reliably set it above 4096; no race or specific uncontrollable memory layout is required to trigger the out-of-bounds read.\nPR:N - The vulnerable code runs during the msgr1 auth handshake, before the peer is authenticated and over an unencrypted channel, so a malicious/MITM monitor needs no credentials on the victim system.\nUI:N - Once a Ceph mount/RBD map exists, the client connects and re-authenticates to monitors automatically (including on connection faults), so no per-exploit victim action is required.\nS:U - The out-of-bounds read and resulting crash occur entirely within the kernel's own security authority with no crossing of a security boundary.\nC:H - Kernel heap memory beyond the 4096-byte front buffer (up to ~2GB) is read and transmitted over the network to the attacker, an unbounded information disclosure that can leak pointers, keys, and other message data.\nI:N - The attacker-controlled value only sets a length field used to read and send data; no kernel memory is written or corrupted and there is no control-flow hijack primitive.\nA:H - Setting `result` to a large positive value makes the send path read past mapped memory, causing a kernel oops/crash."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ceph/auth.c", "net/ceph/mon_client.c"], "versions": [{"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc", "lessThan": "c2374b92c729d0388a538b3cde7b3e3b5e55ef39", "status": "affected", "versionType": "git"}, {"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc", "lessThan": "38fdf04c602d52c42c67fc1617211492753b7e8b", "status": "affected", "versionType": "git"}, {"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc", "lessThan": "2ae0afd98432536562fa8261538ae795446f0589", "status": "affected", "versionType": "git"}, {"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc", "lessThan": "408e85ee708b6aa03eeb0220ffa0915f4d407181", "status": "affected", "versionType": "git"}, {"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc", "lessThan": "b7df9fbd4869fdfe09a3f501ffd228486521e062", "status": "affected", "versionType": "git"}, {"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc", "lessThan": "8517b6c8d2c759918ba0058cb6c7e14d59643202", "status": "affected", "versionType": "git"}, {"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc", "lessThan": "1c439de70b1c3eb3c6bffa8245c16b9fc318f114", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ceph/auth.c", "net/ceph/mon_client.c"], "versions": [{"version": "2.6.34", "status": "affected"}, {"version": "0", "lessThan": "2.6.34", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.140", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.88", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.30", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.7", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "6.6.140"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "6.12.88"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "6.18.30"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "7.0.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c2374b92c729d0388a538b3cde7b3e3b5e55ef39"}, {"url": "https://git.kernel.org/stable/c/38fdf04c602d52c42c67fc1617211492753b7e8b"}, {"url": "https://git.kernel.org/stable/c/2ae0afd98432536562fa8261538ae795446f0589"}, {"url": "https://git.kernel.org/stable/c/408e85ee708b6aa03eeb0220ffa0915f4d407181"}, {"url": "https://git.kernel.org/stable/c/b7df9fbd4869fdfe09a3f501ffd228486521e062"}, {"url": "https://git.kernel.org/stable/c/8517b6c8d2c759918ba0058cb6c7e14d59643202"}, {"url": "https://git.kernel.org/stable/c/1c439de70b1c3eb3c6bffa8245c16b9fc318f114"}], "title": "libceph: Fix slab-out-of-bounds access in auth message processing", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46119", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:19:58.794269Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:19:59.436Z"}, "title": "CISA ADP Vulnrichment"}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ceph/auth.c", "net/ceph/mon_client.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c2374b92c729d0388a538b3cde7b3e3b5e55ef39", "status": "affected", "version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc", "versionType": "git"}, {"lessThan": "38fdf04c602d52c42c67fc1617211492753b7e8b", "status": "affected", "version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc", "versionType": "git"}, {"lessThan": "2ae0afd98432536562fa8261538ae795446f0589", "status": "affected", "version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc", "versionType": "git"}, {"lessThan": "408e85ee708b6aa03eeb0220ffa0915f4d407181", "status": "affected", "version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc", "versionType": "git"}, {"lessThan": "b7df9fbd4869fdfe09a3f501ffd228486521e062", "status": "affected", "version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc", "versionType": "git"}, {"lessThan": "8517b6c8d2c759918ba0058cb6c7e14d59643202", "status": "affected", "version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc", "versionType": "git"}, {"lessThan": "1c439de70b1c3eb3c6bffa8245c16b9fc318f114", "status": "affected", "version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ceph/auth.c", "net/ceph/mon_client.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.34"}, {"lessThan": "2.6.34", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.140", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.88", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.30", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "66FEB83E-2D81-4BA1-B8BE-C61B1BC97290", "versionEndExcluding": "5.15.209", "versionStartIncluding": "2.6.34.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "92385813-D91D-480D-83A1-F423D2CBB2BA", "versionEndExcluding": "6.1.175", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A1A92866-F406-43B5-B2D1-CFC274753E9D", "versionEndExcluding": "6.6.140", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5AFBE0EC-CCDF-4207-AE92-ABF958125CA4", "versionEndExcluding": "6.12.88", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B", "versionEndExcluding": "6.18.30", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D0893CA7-9AE6-4DFE-AC75-48967D73AD8E", "versionEndExcluding": "7.0.7", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:-:*:*:*:*:*:*", "matchCriteriaId": "A3B1BC1D-ED46-4364-A1D9-1FA74182B03A", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc2:*:*:*:*:*:*", "matchCriteriaId": "86D3F64C-3F27-43E0-B0D4-62CE1E1F4EFB", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc3:*:*:*:*:*:*", "matchCriteriaId": "7927713B-5EB0-41EB-86A9-9935775162E0", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc4:*:*:*:*:*:*", "matchCriteriaId": "59037296-3143-4FBB-AFF7-D4FE2C85502F", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc5:*:*:*:*:*:*", "matchCriteriaId": "9CA27FD5-7DBF-4C85-80A9-D523B2E4B033", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc6:*:*:*:*:*:*", "matchCriteriaId": "9711E333-A8E7-4F4B-BCFD-2023E889651A", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc7:*:*:*:*:*:*", "matchCriteriaId": "E04D3358-973B-42A1-8E08-2E3AE947193C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Fix slab-out-of-bounds access in auth message processing\n\nIf a (potentially corrupted) message of type CEPH_MSG_AUTH_REPLY\ncontains a positive value in its result field, it is treated as an\nerror code by ceph_handle_auth_reply() and returned to\nhandle_auth_reply(). Thereafter, an attempt is made to send the\npreallocated message of type CEPH_MSG_AUTH, where the returned value is\ninterpreted as the size of the front segment to send. If the result\nvalue in the message is greater than the size of the memory buffer\nallocated for the front segment, an out-of-bounds access occurs, and\nthe content of the memory region beyond this buffer is sent out.\n\nThis patch fixes the issue by treating only negative values in the\nresult field as errors. Positive values are therefore treated as success\nin the same way as a zero value. Additionally, a BUG_ON is added to\n__send_prepared_auth_request() comparing the len parameter to\nfront_alloc_len to prevent sending the message if it exceeds the bounds\nof the allocation and to make it easier to catch any logic flaws leading\nto this."}], "id": "CVE-2026-46119", "lastModified": "2026-10-19T20:18:32.757", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46119", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:19:58.794269Z", "version": "2.0.3"}}]}, "published": "2026-05-28T10:16:27.390", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1c439de70b1c3eb3c6bffa8245c16b9fc318f114"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2ae0afd98432536562fa8261538ae795446f0589"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/38fdf04c602d52c42c67fc1617211492753b7e8b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/408e85ee708b6aa03eeb0220ffa0915f4d407181"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8517b6c8d2c759918ba0058cb6c7e14d59643202"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b7df9fbd4869fdfe09a3f501ffd228486521e062"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c2374b92c729d0388a538b3cde7b3e3b5e55ef39"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Undergoing Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: libceph: Fix slab-out-of-bounds access in auth message processing", "id": "2482621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482621"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-131", "details": ["A flaw was found in the Linux kernel's libceph component. A remote attacker could exploit this vulnerability by sending a specially crafted CEPH_MSG_AUTH_REPLY message. When the message's result field contains a positive value, it can be misinterpreted as a buffer size, leading to a slab-out-of-bounds read. This allows the attacker to disclose sensitive information from memory beyond the intended buffer."], "name": "CVE-2026-46119", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-46119\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46119\nhttps://lore.kernel.org/linux-cve-announce/2026052814-CVE-2026-46119-13b0@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,2ae0afd98432536562fa8261538ae795446f0589)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,408e85ee708b6aa03eeb0220ffa0915f4d407181)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b7df9fbd4869fdfe09a3f501ffd228486521e062)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,8517b6c8d2c759918ba0058cb6c7e14d59643202)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1c439de70b1c3eb3c6bffa8245c16b9fc318f114)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.6.140)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.12.88)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.30)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.0.7)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.140,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.88,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.30,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.7,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-28T12:30:16.582055+00:00", "updated": "2026-10-23T01:00:18.705118+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}