CVE-2026-23201: ceph: fix oops due to invalid pointer for kfree() in parse_longname()
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix oops due to invalid pointer for kfree() in parselongname()
This fixes a kernel oops when reading ceph snapshot directories (.snap), for example by simply running ls /mnt/myceph/.snap.
The variable str is guarded by free(kfree), but advanced by one for skipping the initial '' in snapshot names. Thus, kfree() is called with an invalid pointer. This patch removes the need for advancing the pointer so kfree() is called with correct memory pointer.
Steps to reproduce:
1. Create snapshots on a cephfs volume (I've 63 snaps in my testcase)
2. Add cephfs mount to fstab $ echo "samba-fileserver@.files=/volumes/datapool/stuff/3461082b-ecc9-4e82-8549-3fd2590d3fb6 /mnt/test/stuff ceph acl,noatime,netdev 0 0" >> /etc/fstab
3. Reboot the system $ systemctl reboot
4. Check if it's really mounted $ mount | grep stuff
5. List snapshots (expected 63 snapshots on my system) $ ls /mnt/test/stuff/.snap
Now ls hangs forever and the kernel log shows the oops.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23201?
CVE-2026-23201 is classified with a low severity due to its specific conditions for exploitation.
How does CVE-2026-23201 affect Linux Kernel users?
CVE-2026-23201 can lead to a kernel oops when accessing ceph snapshot directories, potentially affecting system stability.
How do I fix CVE-2026-23201?
To fix CVE-2026-23201, upgrade your Linux kernel to the latest version where the vulnerability has been resolved.
Is CVE-2026-23201 specifically related to ceph functionality?
Yes, CVE-2026-23201 is specifically related to the ceph filesystem's functionality in the Linux kernel.
Can CVE-2026-23201 lead to data loss or corruption?
While CVE-2026-23201 may cause system crashes, it is not directly linked to data loss or corruption.