PT-2026-90367

In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fs name decode in handle session handle session decodes the MDSCapAuth records carried by a CEPH SESSION OPEN message msg version = 6. For each record the match.path and match.fs name byte strings...

PT-2026-90370

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in check new map on session freed during unlock check new map iterates mdsc-sessions and for each active session drops mdsc-mutex to perform per-session operations. The forced-close path rank removed from map...

PT-2026-90371

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in kick flushing caps on cf entry freed during unlock list for each entry iterates ci-i cap flush list but drops i ceph lock to send cap messages. During the unlock window, handle cap flush ack can acquire i ceph...

PT-2026-90363

In the Linux kernel, the following vulnerability has been resolved: ceph: do not repeat ceph trim dentries if no progress possible ceph cap reclaim work re-queues itself for as long as ceph trim dentries returns -EAGAIN, which happens whenever a lease walk exhausts its nr to scan budget. This...

PT-2026-90362

In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount ceph dirty folio takes a wrbuffer claim on each newly dirtied folio: it bumps i wrbuffer ref taking an ihold on the 0-1 transition and attaches the snap context to...

PT-2026-90364

In the Linux kernel, the following vulnerability has been resolved: ceph: cap delegated inode count in ceph parse deleg inos ceph parse deleg inos decodes interval sets of delegated inode numbers from an MDS create-with-delegation reply. For each set it reads a 64-bit start and a 64-bit len with...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107272)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107272 advisory. In the Linux kernel, the following vulnerability has been resolved: ceph: blocklist the kclient when receiving corrupted snap trace When received corrupted snap trac...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107263)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107263 advisory. In the Linux kernel, the following vulnerability has been resolved: ceph: drop messages from MDS when unmounting When unmounting all the dirty buffers will be flushe...

PT-2026-90366

In the Linux kernel, the following vulnerability has been resolved: ceph: bound num export targets array for mds info v2/v3 ceph mdsmap decode in fs/ceph/mdsmap.c reads num export targets from each per-mds info record and advances the decode cursor by num export targets sizeofu32 without first...

Updated ceph packages fix security vulnerabilities

Updated ceph packages fix various security issues allowing authentication bypasses to gain admin privileges on the OSD, MDS, and MGR services. Notice that some of the fixes require kernel support for aes256k introduced in kernel 7. This update will not break installs using the old and insecure AE...

MGASA-2026-0389 Updated ceph packages fix security vulnerabilities

Updated ceph packages fix various security issues allowing authentication bypasses to gain admin privileges on the OSD, MDS, and MGR services. Notice that some of the fixes require kernel support for aes256k introduced in kernel 7. This update will not break installs using the old and insecure AE...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053338)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053338 advisory. In the Linux kernel, the following vulnerability has been resolved: ceph: only dadd negative dentries when they are unhashed Ceph can call dadddentry, NULL on a...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053239)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053239 advisory. In the Linux kernel, the following vulnerability has been resolved: ceph: remove the incorrect Fw reference check when dirtying pages When doing the direct-io reads ...

The vulnerability of the decode_choose_args() function in the net/ceph/osdmap.c module, which is part of the Linux kernel’s networking functions, allows a hacker to trigger a service failure.

The vulnerability of the decodechooseargs function in the net/ceph/osdmap.c module, which is responsible for implementing networking functions of the Linux kernel, is related to an uncontrolled and exploitable condition. Exploiting this vulnerability could allow a malicious actor to cause service...

The vulnerability of the crush_decode() function in the net/ceph/osdmap.c kernel of the Linux operating system allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the crushdecode function in the net/ceph/osdmap.c module of the Linux kernel is related to incorrect assumptions regarding the organization of data or memory. Exploiting this vulnerability can allow a remote attacker to compromise the confidentiality, integrity, and...

The vulnerability of the decode_choose_args() function in the net/ceph/osdmap.c module, which is part of the Linux kernel’s networking functions, allows a hacker to trigger a service failure.

The vulnerability of the decodechooseargs function in the net/ceph/osdmap.c module, which is part of the Linux kernel’s networking functions, stems from an improper check of the specified index, position, or offset in the input data. Exploiting this vulnerability could allow a remote attacker to...

The vulnerability of the __ceph_x_decrypt() function in the net/ceph/auth_x.c module, which is part of the networking functions in the Linux kernel, allows a hacker to cause a service failure.

The vulnerability of the cephxdecrypt function in the net/ceph/authx.c module, which is part of the networking functions in the Linux kernel, relates to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a remote attacker to cause service...

The vulnerability of the osdmap_decode() function in the net/ceph/osdmap.c module, which is part of the Linux kernel’s networking functions, allows a hacker to gain access to protected information or cause service interruptions.

The vulnerability of the osdmapdecode function in the net/ceph/osdmap.c module, which is part of the Linux kernel’s networking functions, is related to incorrect input of configuration data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to protected...

BIT-CEPH-2026-54330 Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway RGW SigV4 handler does not reject requests that carry x-amz- headers absent from the signed header set, allowing anyone holding a presigne...

BIT-CEPH-2026-50152 Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only mon allow r capabilities to...