Critical 9.1Published May 8, 2026

CVE-2026-43406libceph: prevent potential out-of-bounds reads in process_message_header()

Updated under an hour ago (Oct 27, 2026, 5:10 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in process_message_header() If the message frame is (maliciously) corrupted in a way that the length of the control segment ends up being less than the size of the message header or a different frame is made to look like a message frame, out-of-bounds reads may ensue in process_message_header(). Perform an explicit bounds check before decoding the message header.

CVSS: 9.1 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): CWE-125
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from cd1a677cad994021b19665ed476aea63f5d54f31 before 76ccf21a12c5f6d6790bc32c7da82446d877b2f4; from cd1a677cad994021b19665ed476aea63f5d54f31 before 75582aaa580c11aed4c7731cad6b068b700e7efb; from cd1a677cad994021b19665ed476aea63f5d54f31 before 50156622eb0888e62541d715a98584480a1bc7cb; from cd1a677cad994021b19665ed476aea63f5d54f31 before dbd857a9e1e33ea71eaf3e211877027e533770d1; from cd1a677cad994021b19665ed476aea63f5d54f31 before 69fe5af33fa3806f398d21c081d73c66e5523bc2; from cd1a677cad994021b19665ed476aea63f5d54f31 before 035867ae6f18df0aeedb2a57a5b74091bd4e3fe8; from cd1a677cad994021b19665ed476aea63f5d54f31 before 69fb5d91bba44ecf7eb80530b85fa4fb028921d5	CNA record
linux linux_kernel linux:linux_kernel	from 5.11 before 5.15.203; from 5.16 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.78; from 6.13 before 6.18.19; from 6.19 before 6.19.9; 7.0; 7.0; and 1 more ranges	NVD

References

References

https://git.kernel.org/stable/c/76ccf21a12c5f6d6790bc32c7da82446d877b2f4	patch
https://git.kernel.org/stable/c/75582aaa580c11aed4c7731cad6b068b700e7efb	patch
https://git.kernel.org/stable/c/50156622eb0888e62541d715a98584480a1bc7cb	patch
https://git.kernel.org/stable/c/dbd857a9e1e33ea71eaf3e211877027e533770d1	patch
https://git.kernel.org/stable/c/69fe5af33fa3806f398d21c081d73c66e5523bc2	patch
https://git.kernel.org/stable/c/035867ae6f18df0aeedb2a57a5b74091bd4e3fe8	patch
https://git.kernel.org/stable/c/69fb5d91bba44ecf7eb80530b85fa4fb028921d5	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.