External risk intelligence

Linux Kernel libceph Out-of-Bounds Access in Auth Reply Processing.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-46119

This vulnerability affects the Ceph filesystem client within the Linux kernel. Ceph is a distributed storage system typically used in backend infrastructure, private clouds, or internal data centers. While it uses network communication, it is generally deployed within isolated, trusted internal network segments rather than being exposed directly to the public internet.

Out-of-bounds Read

Linux Kernel

2.6.34.1 to before 5.15.2095.16 to before 6.1.1756.2 to before 6.6.1406.7 to before 6.12.886.13 to before 6.18.306.19 to before 7.0.72.6.34

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Linux kernel's authentication message processing. This issue, if exploited, could lead to unauthorized access to system memory, potentially exposing sensitive information. The affected technology is integral to many operating systems, making it crucial to understand its relevance to our environment.

Memory access vulnerability in Linux kernel.
Critical issue impacts authentication message handling.
Confirm relevance and exposure of this kernel function.

Attack Path

How an attacker could exploit the issue

An attacker could trigger this vulnerability by sending a specially crafted authentication reply message to a system running a vulnerable Linux kernel. If this message contains an unexpectedly large value, the kernel may attempt to read beyond its allocated memory buffer, leading to the exposure of sensitive memory contents.

Requires network access to the vulnerable system.
Triggered by a malformed authentication message.
Can leak unintended memory contents.

Live Threat

Current exploitation, exposure, and threat context

A slab-out-of-bounds access in the Linux kernel's authentication message processing could allow an attacker to disclose memory contents under specific conditions related to corrupted authorization reply messages.

Kernel memory exposure.
Malformed auth reply messages are sent.
Unauthorized access to sensitive information.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Linux kernel's `libceph` component is implicated in this vulnerability, suggesting that teams responsible for storage infrastructure, platform engineering, and potentially the application owners utilizing Ceph should investigate. The immediate practical step is to inventory all systems running the affected Linux kernel versions and identify Ceph deployments. Confirming network reachability and the business criticality of these Ceph instances will inform prioritization for remediation.

Storage and Platform Engineering teams own resolution.
Verify Ceph usage and network exposure.
Plan coordinated kernel updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is libceph in the Linux kernel?

libceph is the core library within the Linux kernel that enables communication with Ceph, a widely used distributed storage system. It is responsible for handling network protocols and authentication messages between a client system and the Ceph storage cluster, providing the underlying infrastructure for scalable data storage in cloud and enterprise environments.

What does CVE-2026-46119 mean?

This vulnerability is an out-of-bounds read error, classified as CWE-125. It occurs because the kernel incorrectly validates a value in an authentication reply message. When the value is unexpectedly large, the system reads past the intended memory buffer, which can leak sensitive kernel memory contents to the network.

How is this vulnerability triggered?

An attacker triggers the bug by sending a specially crafted, malformed authentication reply message to a system using libceph. If the message contains a positive value that exceeds the allocated buffer size, the kernel attempts an invalid memory access. Standard, well-formed messages that do not contain these large, invalid values do not trigger the flaw.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as an 'Unlikely' risk for direct internet-facing exposure. Because libceph is primarily used for backend storage infrastructure and private clouds, these systems are typically located within isolated, trusted internal network segments, making them less accessible to outside attackers than public-facing services.

What should I do to address this CVE?

Begin by inventorying your environment to locate systems running the affected Linux kernel versions that also utilize Ceph storage. Coordinate with your infrastructure and platform engineering teams to plan and apply the necessary kernel updates that include the patch, as these updates are the primary mechanism for resolving this memory handling flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.