CVE-2026-43406: libceph: prevent potential out-of-bounds reads in process_message_header()
In the Linux kernel, the following vulnerability has been resolved:
libceph: prevent potential out-of-bounds reads in processmessageheader()
If the message frame is (maliciously) corrupted in a way that the length of the control segment ends up being less than the size of the message header or a different frame is made to look like a message frame, out-of-bounds reads may ensue in processmessageheader().
Perform an explicit bounds check before decoding the message header.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43406?
CVE-2026-43406 has a critical severity rating of 9.1.
What does CVE-2026-43406 affect?
CVE-2026-43406 affects the Linux kernel, specifically the libceph component.
How does CVE-2026-43406 impact systems?
CVE-2026-43406 could allow for potential out-of-bounds reads, leading to possible data exposure or system instability.
How do I fix CVE-2026-43406?
To fix CVE-2026-43406, update to the latest version of the Linux kernel that includes the patch for this vulnerability.
What should I do if I cannot update for CVE-2026-43406?
If unable to update for CVE-2026-43406, consider applying mitigations such as implementing stricter network controls and monitoring for unusual activity.