CVE-2026-46024 libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()
A null pointer dereference in the Linux kernel's Ceph client allows a remote attacker to cause a denial of service via a crafted authentication reply.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46024?
CVE-2026-46024 is a high-severity vulnerability in Linux kernel, published on 27 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()
If a message of type CEPH_MSG_AUTH_REPLY contains a zero value for both protocol and result, this is currently not treated as an error. In case of ac->negotiating == true and ac->protocol > 0, this leads to setting ac->protocol = 0 and ac->ops = NULL. Thereafter, the check for ac->protocol != protocol returns false, and init_protocol() is not called. Subsequently, ac->ops->handle_reply() is called, which leads to a null pointer dereference, because ac->ops is still NULL.
This patch changes the check for ac->protocol != protocol to !ac->protocol, as this also includes the case when the protocol was set to zero in the message. This causes the message to be treated as containing a bad auth protocol.
Weakness: CWE-476
Which versions are affected by CVE-2026-46024?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-46024?
Apply the vendor's patch.
Is CVE-2026-46024 being exploited?
There is no known exploitation of CVE-2026-46024 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-88563, BELL-CVE-2026-46024, DEBIAN-CVE-2026-46024, GHSA-fmw3-m5fg-w74x, ROOT-OS-DEBIAN-11-CVE-2026-46024, ROOT-OS-DEBIAN-12-CVE-2026-46024 and 3 more.