CVE-2026-22984

In the Linux kernel, the following vulnerability has been resolved:

libceph: prevent potential out-of-bounds reads in handle_auth_done()

Perform an explicit bounds check on payload_len to avoid a possible out-of-bounds access in the callout.

[ idryomov: changelog ]

An out-of-bounds read can occur in libceph messenger v2 during AUTH_DONE handling when payload_len is taken from the wire but the message buffer is not validated to actually contain that many bytes. A malicious or compromised Ceph peer can send a truncated message to reliably crash the kernel (network-triggered DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If Ceph not being used, then possible to disable it. To mitigate this issue, prevent module libceph from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.