CVE-2026-90067

In the Linux kernel, the following vulnerability has been resolved: libceph: validate banner payload length When parsing the Ceph messenger v2 protocol banner, the payloadlen field is decoded from the banner prefix. If a client sends a banner with a payloadlen of 0, the kernel sets up a 0-length...

CVE-2026-90067

CVE-2026-90067 is a Linux kernel vulnerability in the Ceph messenger v2 protocol implementation (net/ceph/messenger_v2.c). When parsing the msgr2 protocol banner, a client sending a payload_len of 0 causes the kernel to set up a 0-length socket read , violating a state-machine invariant and trigg...

kernel: buffer overflow in ceph file net/ceph/messenger_v2.c

An flaw was found in net/ceph/messengerv2.c in the Linux Kernel. An integer signing error leads to a buffer overflow and remote code execution via HELLO or one of the AUTH frames. This issue occurs due to an untrusted length taken from a TCP packet in cephdecode32...