{"id":"CVE-2026-43304","revision":"d1287e44cd424fa5a65c594fe4d0e96b","records":[{"revision":"d1287e44cd424fa5a65c594fe4d0e96b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-43304","aliases":[],"title":"libceph: define and enforce CEPH_MAX_KEY_LEN","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: define and enforce CEPH_MAX_KEY_LEN\n\nWhen decoding the key, verify that the key material would fit into\na fixed-size buffer in process_auth_done() and generally has a sane\nlength.\n\nThe new CEPH_MAX_KEY_LEN check replaces the existing check for a key\nwith no key material which is a) not universal since CEPH_CRYPTO_NONE\nhas to be excluded and b) doesn't provide much value since a smaller\nthan needed key is just as invalid as no key -- this has to be handled\nelsewhere anyway.","state":0,"publishedAt":"2026-05-08T13:11:24.264+00:00","modifiedAt":"2026-10-19T19:16:26.177+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ceph/crypto.c\",\n                        \"net/ceph/crypto.h\",\n                        \"net/ceph/messenger_v2.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"cd1a677cad994021b19665ed476aea63f5d54f31\",\n                            \"lessThan\": \"6405e8c680974bb74e2c98d5249fb52c7b12a6c6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cd1a677cad994021b19665ed476aea63f5d54f31\",\n                            \"lessThan\": \"8d745d38c88ecbed95f6b2b39857bf89f35a3244\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cd1a677cad994021b19665ed476aea63f5d54f31\",\n                            \"lessThan\": \"e1dc45d97975f9db65694d234fbddf1915176e16\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cd1a677cad994021b19665ed476aea63f5d54f31\",\n                            \"lessThan\": \"1b275bd49e58752efb83767a5d1aed41356c5e64\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cd1a677cad994021b19665ed476aea63f5d54f31\",\n                            \"lessThan\": \"c1a0f5f1e5e7e98c36a362ec3d1fcfd9932931ed\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cd1a677cad994021b19665ed476aea63f5d54f31\",\n                            \"lessThan\": \"d82467c07b03a27c3c5469b62bb3b726305a80bb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cd1a677cad994021b19665ed476aea63f5d54f31\",\n                            \"lessThan\": \"ac431d597a9bdfc2ba6b314813f29a6ef2b4a3bf\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ceph/crypto.c\",\n                        \"net/ceph/crypto.h\",\n                        \"net/ceph/messenger_v2.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.11\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.11\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.202\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.165\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.128\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.75\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.16\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19.6\",\n                            \"lessThanOrEqual\": \"6.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/6405e8c680974bb74e2c98d5249fb52c7b12a6c6","https://git.kernel.org/stable/c/8d745d38c88ecbed95f6b2b39857bf89f35a3244","https://git.kernel.org/stable/c/e1dc45d97975f9db65694d234fbddf1915176e16","https://git.kernel.org/stable/c/1b275bd49e58752efb83767a5d1aed41356c5e64","https://git.kernel.org/stable/c/c1a0f5f1e5e7e98c36a362ec3d1fcfd9932931ed","https://git.kernel.org/stable/c/d82467c07b03a27c3c5469b62bb3b726305a80bb","https://git.kernel.org/stable/c/ac431d597a9bdfc2ba6b314813f29a6ef2b4a3bf"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43304","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-43304","identifiers":["CVE-2026-43304"]},"retained":false,"historicalAffected":[]}],"coverage":[]}