CVE-2026-43419: ceph: fix memory leaks in ceph_mdsc_build_path()
Published May 8, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix memory leaks in cephmdscbuildpath()
Add putname() calls to error code paths that did not free the "path" pointer obtained by getname(). If ownership of this pointer is not passed to the caller via pathinfo.path, the function must free it before returning.
Affected Software
11 affected components
Linux Linux kernel (Ceph)
Linux Linux kernel>=5.10.234<5.11
Linux Linux kernel>=5.15.177<5.16
Linux Linux kernel>=6.1.125<6.2
Linux Linux kernel>=6.6<6.6.130
Linux Linux kernel>=6.7<6.12.78
Linux Linux kernel>=6.13<6.18.19
Linux Linux kernel>=6.19<6.19.9
Linux Linux kernel=7.0-rc1
Linux Linux kernel=7.0-rc2
Linux Linux kernel=7.0-rc3
Remediation
Event History
May 8, 2026
CVE Published
via MITRE·02:21 PM
Data Sourced
via MITRE·02:21 PM
Description
Data Sourced
via NVD·03:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-43419?
CVE-2026-43419 has a medium severity rating of 5.5 based on CVSS 3.1 metrics.
2
What is CVE-2026-43419 about?
CVE-2026-43419 addresses memory leaks in the ceph_mdsc_build_path() function within the Linux kernel.
3
How do I fix CVE-2026-43419?
The fix for CVE-2026-43419 is available through a patch that needs to be applied to the affected Linux kernel.
4
Which software versions are affected by CVE-2026-43419?
CVE-2026-43419 affects the Ceph implementation within the Linux kernel.
5
When was CVE-2026-43419 published?
CVE-2026-43419 was published on May 8, 2026.