CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN
In the Linux kernel, the following vulnerability has been resolved:
libceph: define and enforce CEPHMAXKEYLEN
When decoding the key, verify that the key material would fit into a fixed-size buffer in processauthdone() and generally has a sane length.
The new CEPHMAXKEYLEN check replaces the existing check for a key with no key material which is a) not universal since CEPHCRYPTONONE has to be excluded and b) doesn't provide much value since a smaller than needed key is just as invalid as no key -- this has to be handled elsewhere anyway.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43304?
CVE-2026-43304 is classified as a moderate severity vulnerability.
How do I fix CVE-2026-43304?
To fix CVE-2026-43304, you should update the Linux kernel to the latest version that incorporates the fix for this vulnerability.
What component of the Linux kernel does CVE-2026-43304 affect?
CVE-2026-43304 affects the libceph component of the Linux kernel.
What issue does CVE-2026-43304 address?
CVE-2026-43304 addresses the enforcement of a maximum key length defined as CEPH_MAX_KEY_LEN in the libceph module.
When was CVE-2026-43304 published?
CVE-2026-43304 was published on October 24, 2026.