---
id: CVE-2026-46024
title: 'libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()

  If a message of type CEPH_MSG_AUTH_REPLY contains a zero value for both
  protocol and result, this…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc <
    9ded62c302c0342efdb5eda3bf6e75720caad0df
  - >-
    Linux >= 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc <
    f101271fcf55d7eacfefd610b51ec65f46ba8118
  - >-
    Linux >= 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc <
    4b2738b93edad661178340239de657d876b73d3d
  - >-
    Linux >= 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc <
    927e4bd5692f2a4901808822981fb2c8d4456548
  - >-
    Linux >= 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc <
    016bc663657366d386993f63eb31072eb45a2b77
  - >-
    Linux >= 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc <
    8f2be7285941a33a9f72579a23b96392f83c758e
  - >-
    Linux >= 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc <
    5199c125d25aeae8615c4fc31652cc0fe624338e
  - Linux 2.6.34
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T15:18:54.853796Z'
published: '2026-05-27'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:48.793Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-46024'
references:
  - url: 'https://git.kernel.org/stable/c/9ded62c302c0342efdb5eda3bf6e75720caad0df'
  - url: 'https://git.kernel.org/stable/c/f101271fcf55d7eacfefd610b51ec65f46ba8118'
  - url: 'https://git.kernel.org/stable/c/4b2738b93edad661178340239de657d876b73d3d'
  - url: 'https://git.kernel.org/stable/c/927e4bd5692f2a4901808822981fb2c8d4456548'
  - url: 'https://git.kernel.org/stable/c/016bc663657366d386993f63eb31072eb45a2b77'
  - url: 'https://git.kernel.org/stable/c/8f2be7285941a33a9f72579a23b96392f83c758e'
  - url: 'https://git.kernel.org/stable/c/5199c125d25aeae8615c4fc31652cc0fe624338e'
tags:
  - cve.org
epss: 0.007
epssPercentile: 0.52216
ingestedAt: '2026-10-16T17:24:46.703Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()

If a message of type CEPH_MSG_AUTH_REPLY contains a zero value for both
protocol and result, this is currently not treated as an error. In case
of ac->negotiating == true and ac->protocol > 0, this leads to setting
ac->protocol = 0 and ac->ops = NULL. Thereafter, the check for
ac->protocol != protocol returns false, and init_protocol() is not
called. Subsequently, ac->ops->handle_reply() is called, which leads to
a null pointer dereference, because ac->ops is still NULL.

This patch changes the check for ac->protocol != protocol to
!ac->protocol, as this also includes the case when the protocol was set
to zero in the message. This causes the message to be treated as
containing a bad auth protocol.

## Affected

- `Linux >= 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc < 9ded62c302c0342efdb5eda3bf6e75720caad0df`
- `Linux >= 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc < f101271fcf55d7eacfefd610b51ec65f46ba8118`
- `Linux >= 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc < 4b2738b93edad661178340239de657d876b73d3d`
- `Linux >= 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc < 927e4bd5692f2a4901808822981fb2c8d4456548`
- `Linux >= 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc < 016bc663657366d386993f63eb31072eb45a2b77`
- `Linux >= 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc < 8f2be7285941a33a9f72579a23b96392f83c758e`
- `Linux >= 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc < 5199c125d25aeae8615c4fc31652cc0fe624338e`
- `Linux 2.6.34`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.