{"id":"CVE-2026-68156","title":"libceph: refresh auth->authorizer_buf{,_len} after authorizer update","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: refresh auth->authorizer_buf{,_len} after authorizer update\n\nceph_x_create_authorizer() caches au->buf->vec.iov_base and\nau->buf->vec.iov_len in struct ceph_au…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 0bed9b5c523d577378b6f83eab5835fe30c27208 < 2334e9997308305ee4fd508fdfe6086c4150ed60","Linux >= 0bed9b5c523d577378b6f83eab5835fe30c27208 < 79a273df64238a4ade8b709689a78589f755b8ef","Linux >= 0bed9b5c523d577378b6f83eab5835fe30c27208 < 26f814187abceee90dbb29a02133adb4786fbb13","Linux >= 0bed9b5c523d577378b6f83eab5835fe30c27208 < 9d37aec9ffe4e743dabc3f84502e9723e17a30d4","Linux >= 0bed9b5c523d577378b6f83eab5835fe30c27208 < 75e82e8944ac1efe9fdb88bd2f14d9a031282bdf","Linux >= 0bed9b5c523d577378b6f83eab5835fe30c27208 < 0060ec912292a550198d8d18ac95b433c92a7091","Linux >= 0bed9b5c523d577378b6f83eab5835fe30c27208 < 5ecfcd5c05866f185357700b81b461dae4f5ebb2","Linux >= 0bed9b5c523d577378b6f83eab5835fe30c27208 < 937d61f86d377a3aa578adae7a3dfcecdddf9d89","Linux 29c65a277a64645af853e8c9a9b3dda0ddc421e0","Linux d2c7223497cf8228416c70e3f4238ddd6c5bdf3c","Linux >= 3.4.50 < 3.5","Linux >= 3.9.7 < 3.10","Linux 3.10"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-16T15:45:09.780823Z"},"published":"2026-08-10","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:53:01.050Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68156","references":[{"url":"https://git.kernel.org/stable/c/2334e9997308305ee4fd508fdfe6086c4150ed60"},{"url":"https://git.kernel.org/stable/c/79a273df64238a4ade8b709689a78589f755b8ef"},{"url":"https://git.kernel.org/stable/c/26f814187abceee90dbb29a02133adb4786fbb13"},{"url":"https://git.kernel.org/stable/c/9d37aec9ffe4e743dabc3f84502e9723e17a30d4"},{"url":"https://git.kernel.org/stable/c/75e82e8944ac1efe9fdb88bd2f14d9a031282bdf"},{"url":"https://git.kernel.org/stable/c/0060ec912292a550198d8d18ac95b433c92a7091"},{"url":"https://git.kernel.org/stable/c/5ecfcd5c05866f185357700b81b461dae4f5ebb2"},{"url":"https://git.kernel.org/stable/c/937d61f86d377a3aa578adae7a3dfcecdddf9d89"}],"tags":["cve.org"],"epss":0.00694,"epssPercentile":0.51973,"ingestedAt":"2026-10-16T17:24:46.845Z","slug":"CVE-2026-68156","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: refresh auth->authorizer_buf{,_len} after authorizer update\n\nceph_x_create_authorizer() caches au->buf->vec.iov_base and\nau->buf->vec.iov_len in struct ceph_auth_handshake.  These\ncached values are then used by the messenger connect code when\nsending the authorizer.\n\nceph_x_update_authorizer() can rebuild the authorizer when a newer\nservice ticket is available.  If the rebuilt authorizer no longer\nfits in the existing buffer, ceph_x_build_authorizer() drops its\nreference to au->buf and allocates a new one.  If this is the final\nreference, ceph_buffer_put() frees the old ceph_buffer and its\nvec.iov_base, but auth->authorizer_buf still points at that freed\nmemory.\n\nA subsequent msgr1 reconnect can therefore queue the stale pointer\nand trigger a KASAN slab-use-after-free in _copy_from_iter() while\ntcp_sendmsg() copies the authorizer.\n\nRefresh auth->authorizer_buf and auth->authorizer_buf_len after a\nsuccessful authorizer rebuild so the messenger sends the current\nbuffer.\n\n## Affected\n\n- `Linux >= 0bed9b5c523d577378b6f83eab5835fe30c27208 < 2334e9997308305ee4fd508fdfe6086c4150ed60`\n- `Linux >= 0bed9b5c523d577378b6f83eab5835fe30c27208 < 79a273df64238a4ade8b709689a78589f755b8ef`\n- `Linux >= 0bed9b5c523d577378b6f83eab5835fe30c27208 < 26f814187abceee90dbb29a02133adb4786fbb13`\n- `Linux >= 0bed9b5c523d577378b6f83eab5835fe30c27208 < 9d37aec9ffe4e743dabc3f84502e9723e17a30d4`\n- `Linux >= 0bed9b5c523d577378b6f83eab5835fe30c27208 < 75e82e8944ac1efe9fdb88bd2f14d9a031282bdf`\n- `Linux >= 0bed9b5c523d577378b6f83eab5835fe30c27208 < 0060ec912292a550198d8d18ac95b433c92a7091`\n- `Linux >= 0bed9b5c523d577378b6f83eab5835fe30c27208 < 5ecfcd5c05866f185357700b81b461dae4f5ebb2`\n- `Linux >= 0bed9b5c523d577378b6f83eab5835fe30c27208 < 937d61f86d377a3aa578adae7a3dfcecdddf9d89`\n- `Linux 29c65a277a64645af853e8c9a9b3dda0ddc421e0`\n- `Linux d2c7223497cf8228416c70e3f4238ddd6c5bdf3c`\n- `Linux >= 3.4.50 < 3.5`\n- `Linux >= 3.9.7 < 3.10`\n- `Linux 3.10`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}