{"id":"CVE-2026-43406","title":"libceph: prevent potential out-of-bounds reads in process_message_header()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: prevent potential out-of-bounds reads in process_message_header()\n\nIf the message frame is (maliciously) corrupted in a way that the\nlength of the control segm…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= cd1a677cad994021b19665ed476aea63f5d54f31 < 76ccf21a12c5f6d6790bc32c7da82446d877b2f4","Linux >= cd1a677cad994021b19665ed476aea63f5d54f31 < 75582aaa580c11aed4c7731cad6b068b700e7efb","Linux >= cd1a677cad994021b19665ed476aea63f5d54f31 < 50156622eb0888e62541d715a98584480a1bc7cb","Linux >= cd1a677cad994021b19665ed476aea63f5d54f31 < dbd857a9e1e33ea71eaf3e211877027e533770d1","Linux >= cd1a677cad994021b19665ed476aea63f5d54f31 < 69fe5af33fa3806f398d21c081d73c66e5523bc2","Linux >= cd1a677cad994021b19665ed476aea63f5d54f31 < 035867ae6f18df0aeedb2a57a5b74091bd4e3fe8","Linux >= cd1a677cad994021b19665ed476aea63f5d54f31 < 69fb5d91bba44ecf7eb80530b85fa4fb028921d5","Linux 5.11"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-16T15:17:09.082944Z"},"published":"2026-05-08","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:20:41.086Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43406","references":[{"url":"https://git.kernel.org/stable/c/76ccf21a12c5f6d6790bc32c7da82446d877b2f4"},{"url":"https://git.kernel.org/stable/c/75582aaa580c11aed4c7731cad6b068b700e7efb"},{"url":"https://git.kernel.org/stable/c/50156622eb0888e62541d715a98584480a1bc7cb"},{"url":"https://git.kernel.org/stable/c/dbd857a9e1e33ea71eaf3e211877027e533770d1"},{"url":"https://git.kernel.org/stable/c/69fe5af33fa3806f398d21c081d73c66e5523bc2"},{"url":"https://git.kernel.org/stable/c/035867ae6f18df0aeedb2a57a5b74091bd4e3fe8"},{"url":"https://git.kernel.org/stable/c/69fb5d91bba44ecf7eb80530b85fa4fb028921d5"}],"tags":["cve.org"],"epss":0.00718,"epssPercentile":0.52913,"ingestedAt":"2026-10-16T17:24:46.695Z","slug":"CVE-2026-43406","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: prevent potential out-of-bounds reads in process_message_header()\n\nIf the message frame is (maliciously) corrupted in a way that the\nlength of the control segment ends up being less than the size of the\nmessage header or a different frame is made to look like a message\nframe, out-of-bounds reads may ensue in process_message_header().\n\nPerform an explicit bounds check before decoding the message header.\n\n## Affected\n\n- `Linux >= cd1a677cad994021b19665ed476aea63f5d54f31 < 76ccf21a12c5f6d6790bc32c7da82446d877b2f4`\n- `Linux >= cd1a677cad994021b19665ed476aea63f5d54f31 < 75582aaa580c11aed4c7731cad6b068b700e7efb`\n- `Linux >= cd1a677cad994021b19665ed476aea63f5d54f31 < 50156622eb0888e62541d715a98584480a1bc7cb`\n- `Linux >= cd1a677cad994021b19665ed476aea63f5d54f31 < dbd857a9e1e33ea71eaf3e211877027e533770d1`\n- `Linux >= cd1a677cad994021b19665ed476aea63f5d54f31 < 69fe5af33fa3806f398d21c081d73c66e5523bc2`\n- `Linux >= cd1a677cad994021b19665ed476aea63f5d54f31 < 035867ae6f18df0aeedb2a57a5b74091bd4e3fe8`\n- `Linux >= cd1a677cad994021b19665ed476aea63f5d54f31 < 69fb5d91bba44ecf7eb80530b85fa4fb028921d5`\n- `Linux 5.11`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}