CVE-2026-68156: libceph: refresh auth->authorizer_buf{,_len} after authorizer update
In the Linux kernel, the following vulnerability has been resolved:
libceph: refresh auth->authorizerbuf{,len} after authorizer update
cephxcreateauthorizer() caches au->buf->vec.iovbase and au->buf->vec.iovlen in struct cephauthhandshake. These cached values are then used by the messenger connect code when sending the authorizer.
cephxupdateauthorizer() can rebuild the authorizer when a newer service ticket is available. If the rebuilt authorizer no longer fits in the existing buffer, cephxbuildauthorizer() drops its reference to au->buf and allocates a new one. If this is the final reference, cephbufferput() frees the old cephbuffer and its vec.iovbase, but auth->authorizerbuf still points at that freed memory.
A subsequent msgr1 reconnect can therefore queue the stale pointer and trigger a KASAN slab-use-after-free in copyfromiter() while tcpsendmsg() copies the authorizer.
Refresh auth->authorizerbuf and auth->authorizerbuflen after a successful authorizer rebuild so the messenger sends the current buffer.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68156?
CVE-2026-68156 has a risk score of 37, indicating a moderate severity level.
How do I fix CVE-2026-68156?
To resolve CVE-2026-68156, ensure you update to the patched version of the Linux kernel that addresses the vulnerability.
What type of vulnerability is CVE-2026-68156?
CVE-2026-68156 is classified as a Use After Free vulnerability in the libceph component of the Linux kernel.
What are the potential impacts of CVE-2026-68156?
Exploitation of CVE-2026-68156 could potentially lead to unauthorized access or system instability due to improper handling of memory.
Is CVE-2026-68156 present in all versions of the Linux kernel?
No, CVE-2026-68156 is specific to certain versions of the Linux kernel that include the affected libceph functionality.