advisories

LinnemanLabs Research and Advisories Security research, advisories, and proof-of-concept code from LinnemanLabs. Advisories and Research Links to write-ups, disclosures, and reproducible PoCs. Project| Findings / Techniques| CVEs| Result| Write-up| PoC ---|---|---|---|---|--- bluez| ?| ?| LPE to...

CVE-2026-89990

A flaw was found in the Ceph filesystem module of the Linux kernel. A local attacker could trigger a use-after-free vulnerability in the cephmdscheckaccess function. This occurs when a concurrent session reopens and frees an array while it is still being accessed, leading to a system crash and...

Critical: Red Hat Security Advisory: New container image: rhceph-9.2

A new version of Red Hat build of Ceph Storage has been released The Red Hat Storage Ceph container images are based on the latest ubi10 base image and Ceph 9.2. This release updates to the latest version...

RHEL 9 : Red Hat Ceph Storage 8.1 (RHSA-2026:79101)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:79101 advisory. Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage syste...

Astra Linux – Vulnerability in Ceph

No description...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: TCP: The check skb variable is not NULL in tcprtodeltaus. We have some machines running stock Ubuntu 20.04.6; these machines use the 5.4.0-174-generic kernel and run Ceph. Recently, a NULL pointer dereference occurred in...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: In ceph, there is a fix for a UAF Uninitialized Address Fault in kickflushingcaps, where a CF entry is freed during the unlock process. In listforeachentry, the variable ci-icapflushlist is iterated over, but the variable icephlo...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: libceph: Use u32 for non-negative values in cephmonmapDecode This patch fixes unnecessary implicit conversions that change the signedness of bloblen and nummon in cephmonmapDecode. Currently, bloblen and nummon are signed int...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: libceph: fixed a race condition between delayedwork and cephmoncstop The way delayed work is handled in cephmoncstop is prone to races with monfault, and possibly also finishhunting. Both of these can requeue the delayed work,...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: libceph: Defined and enforced the CEPHMAXKEYLEN. When decoding the key, verify that the key material fits into a fixed-size buffer in processauthdone, and that its length is reasonable. The new CEPHMAXKEYLEN check replaces the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Ceph: Proper snapshot context was provided for the cephzeropartialobject function. The cephzeropartialobject function lacked the correct snapshot context for its OSD write operations, which could lead to inconsistencies in...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ceph: fixed a deadlock or deadcode issue caused by misuse of dget. The lock order between denty and its parent is incorrect; we should always ensure that the parent gets the lock first. However, since this deadcode is never used,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Ceph: The dadd function only calls dadd, provided that the dentry is not already hashed. Ceph can call dadddentry, NULL on a negative dentry that already exists in the primary dcache hash. The current VFS implementation is not...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: libceph: The handler error from monhandleauthdone should be returned. Currently, any error from cephauthhandlereplydone is propagated via finishauth, but it is not returned from monhandleauthdone. This results in higher layers...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: libceph: Replace BUGON with a bounds check for map-maxosd. OSD indexes originate from untrusted network packets. Boundaries checks have been added to validate these indexes against map-maxosd. idryomov: removed BUGON in...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ceph: Rejects ranks outside CEPHMAXMDS in mdsmap decoding The exporttargets entries in MDSMap are monitored by the kernel. The checknewmap function uses each entry as a bit in a fixed stack bitmap. Therefore, ranks outside the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ceph: A buffer leak in cephsetxattr has been fixed. In the cephsetxattr function, the oldblob can store the ci-ixattrs.preallocblob value during a retry. However, the cephbufferput method is never called for the oldblob object...

Important: Red Hat Security Advisory: Red Hat Ceph Storage

A new version of Red Hat build of Ceph Storage has been released The Red Hat Storage Ceph container images are based on the latest ubi9 base image and Ceph 7.1. This release updates to the latest version...

AZL-108327 CVE-2026-86847 affecting package ceph 18.2.2-13

A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash...

CVE-2026-90067

A flaw was found in the Linux kernel's libceph component. A remote attacker could exploit this by sending a specially crafted Ceph messenger v2 protocol banner with a zero-length payload. This malformed banner causes the kernel to attempt a zero-length socket read, which violates internal state...