Ceph Kernel Vulnerability in Linux Kernel Affects Multiple Systems

CVE-2026-43408

What is CVE-2026-43408?

A vulnerability in the Ceph functionalities of the Linux kernel can lead to system crashes due to uninitialized memory in the ceph_path_info structure. When the ceph_mdsc_build_path() function is called without initializing this structure, it risks triggering random crashes or potentially allowing privilege escalation through improper handling of failed path build operations. This flaw arises because some callers of ceph_mdsc_build_path() do not properly initialize their parameters, which results in unsafe calls to ceph_mdsc_free_path_info() following a failed execution. A patch has been implemented to ensure that this structure is initialized correctly in all relevant functions.

References