CVE-2026-46119: libceph: Fix slab-out-of-bounds access in auth message processing

Synopsis

A slab-out-of-bounds memory access vulnerability exists in the Linux kernel's libceph subsystem, specifically in the auth message processing path. The flaw is reachable over the network without any authentication, triggered by a crafted or corrupted CEPH_MSG_AUTH_REPLY message carrying a positive value in its result field; this causes the kernel to treat that value as a buffer size and read beyond the allocated front-segment buffer. Successful exploitation leaks kernel memory contents to a remote attacker and can also crash the affected service. A patched-image rebuild at fix version 6.6.140 (and associated commit SHAs) is available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Ceph monitor or auth service over the network; the vulnerable code path is exercised when a crafted CEPH_MSG_AUTH_REPLY packet is received from a network-accessible endpoint.

• AuthenticationNot required

  No credentials are needed; the vulnerable parsing occurs before any successful authentication is established, so an unauthenticated network peer can trigger it.

• Victim interactionNot required

  No user or operator action is required; the kernel processes the incoming auth reply passively without any interactive step.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, special memory layout, or other environmental preconditions beyond network access to the Ceph auth endpoint.

Blast Radius

• Reads and transmits kernel slab memory contents beyond the allocated auth buffer to the attacker, potentially exposing in-memory secrets, keys, or other sensitive kernel data.
• Can crash the affected kernel or Ceph client process by inducing an out-of-bounds memory access, causing a denial of service for workloads depending on the Ceph storage backend.
• Any container or pod relying on CephFS or RBD volumes on the affected host becomes unavailable if the kernel panics or the ceph-client crashes.
• Kernel memory disclosure may expose credentials or session tokens held in adjacent slab allocations, widening the attack surface for follow-on exploitation.