CVE-2026-23201 ceph: fix oops due to invalid pointer for kfree() in parse_longname()
A kernel oops occurs when listing CephFS snapshot directories due to an invalid pointer passed to kfree, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23201?
CVE-2026-23201 is a medium-severity vulnerability in Linux kernel, published on 14 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix oops due to invalid pointer for kfree() in parse_longname()
This fixes a kernel oops when reading ceph snapshot directories (.snap), for example by simply running `ls /mnt/my_ceph/.snap`.
The variable str is guarded by __free(kfree), but advanced by one for skipping the initial '_' in snapshot names. Thus, kfree() is called with an invalid pointer. This patch removes the need for advancing the pointer so kfree() is called with correct memory pointer.
Steps to reproduce:
1. Create snapshots on a cephfs volume (I've 63 snaps in my testcase)
2. Add cephfs mount to fstab $ echo "[email protected]=/volumes/datapool/stuff/3461082b-ecc9-4e82-8549-3fd2590d3fb6 /mnt/test/stuff ceph acl,noatime,_netdev 0 0" >> /etc/fstab
3. Reboot the system $ systemctl reboot
4. Check if it's really mounted $ mount | grep stuff
5. List snapshots (expected 63 snapshots on my system) $ ls /mnt/test/stuff/.snap
Now ls hangs forever and the kernel log shows the oops.
Weakness: CWE-476
Which versions are affected by CVE-2026-23201?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23201?
Apply the vendor's patch.
Is CVE-2026-23201 being exploited?
There is no known exploitation of CVE-2026-23201 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-23201, DEBIAN-CVE-2026-23201, GHSA-3mg9-9f72-h562, ROOT-OS-DEBIAN-13-CVE-2026-23201, ROOT-OS-UBUNTU-2404-CVE-2026-23201, UBUNTU-CVE-2026-23201.