CVE-2026-46119

A flaw was found in the Linux kernel's libceph component. A remote attacker could exploit this vulnerability by sending a specially crafted CEPH_MSG_AUTH_REPLY message. When the message's result field contains a positive value, it can be misinterpreted as a buffer size, leading to a slab-out-of-bounds read. This allows the attacker to disclose sensitive information from memory beyond the intended buffer.

This vulnerability is rated as Moderate severity because exploitation requires an established connection to a malicious or compromised Ceph cluster monitor capable of delivering manipulated authentication response packets. The libceph kernel module is not loaded by default on Red Hat Enterprise Linux installations unless Ceph storage services, CephFS mounts, or RBD block devices are explicitly configured. Consequently, standard deployments that do not consume Ceph storage remain unexposed to remote memory disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.