NetSight
IP …
critical9.8

CVE-2026-43304

In the Linux kernel, the following vulnerability has been resolved: libceph: define and enforce CEPH_MAX_KEY_LEN When decoding the key, verify that the key mat…

Impact

In the Linux kernel, the following vulnerability has been resolved: libceph: define and enforce CEPH_MAX_KEY_LEN When decoding the key, verify that the key material would fit into a fixed-size buffer in process_auth_done() and generally has a sane length. The new CEPH_MAX_KEY_LEN check replaces the existing check for a key with no key material which is a) not universal since CEPH_CRYPTO_NONE has to be excluded and b) doesn't provide much value since a smaller than needed key is just as invalid as no key -- this has to be handled elsewhere anyway.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 5.11 before 5.15.202
from 5.16 before 6.1.165
from 6.2 before 6.6.128
from 6.7 before 6.12.75
from 6.13 before 6.18.16
from 6.19 before 6.19.6

Weakness classification

CWE-121

References