Linux Distros Unpatched Vulnerability : CVE-2026-90067

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libceph: validate banner payload length When parsing the Ceph messenger v2 protocol banner, the payloadlen field is decoded from the banner prefix. If a client...

EulerOS Virtualization 2.12.0 : kernel (EulerOS-SA-2026-3644)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : dlm: validate length in dlmsearchrsbtreeCVE-2026-43125 net: annotate data-races around sk-skdataready,writespaceCVE-2026-23302...

Oracle Linux 9 : kernel (ELSA-2026-68570)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-68570 advisory. - selinux: check connect-related permissions on TCP Fast Open CKI Backport Bot RHEL-258014 CVE-2026-72243 - wifi: mac80211: limit injected antenna ind...

DEBIAN-CVE-2026-90067

In the Linux kernel, the following vulnerability has been resolved: libceph: validate banner payload length When parsing the Ceph messenger v2 protocol banner, the payloadlen field is decoded from the banner prefix. If a client sends a banner with a payloadlen of 0, the kernel sets up a 0-length...

AZL-102594 CVE-2026-90067 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: libceph: validate banner payload length When parsing the Ceph messenger v2 protocol banner, the payloadlen field is decoded from the banner prefix. If a client sends a banner with a payloadlen of 0, the kernel sets up a 0-length...

CVE-2026-90067

In the Linux kernel, the following vulnerability has been resolved: libceph: validate banner payload length When parsing the Ceph messenger v2 protocol banner, the payloadlen field is decoded from the banner prefix. If a client sends a banner with a payloadlen of 0, the kernel sets up a 0-length...

CVE-2026-90067

CVE-2026-90067 is a Linux kernel vulnerability in the Ceph messenger v2 protocol implementation (net/ceph/messenger_v2.c). When parsing the msgr2 protocol banner, a client sending a payload_len of 0 causes the kernel to set up a 0-length socket read , violating a state-machine invariant and trigg...

EUVD-2026-81928

In the Linux kernel, the following vulnerability has been resolved: libceph: validate banner payload length When parsing the Ceph messenger v2 protocol banner, the payloadlen field is decoded from the banner prefix. If a client sends a banner with a payloadlen of 0, the kernel sets up a 0-length...

CVE-2026-90067 libceph: validate banner payload length

In the Linux kernel, the following vulnerability has been resolved: libceph: validate banner payload length When parsing the Ceph messenger v2 protocol banner, the payloadlen field is decoded from the banner prefix. If a client sends a banner with a payloadlen of 0, the kernel sets up a 0-length...

CVE-2026-90067 libceph: validate banner payload length

In the Linux kernel, the following vulnerability has been resolved: libceph: validate banner payload length When parsing the Ceph messenger v2 protocol banner, the payloadlen field is decoded from the banner prefix. If a client sends a banner with a payloadlen of 0, the kernel sets up a 0-length...

kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap

A flaw was found in libceph in the Linux kernel. A remote attacker, acting as a malicious monitor, could send a specially crafted OSDMap Object Storage Device Map with an overly long pgtemp or pgupmap entry. This could lead to a stack out-of-bounds write, resulting in a kernel bug and potentially...

PT-2026-94415

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the libceph component when parsing the Ceph messenger v2 protocol banner. The payload len field is decoded from the banner prefix; if a client provides a payload len o...

CVE-2026-90067: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: libceph: validate banner payload length When parsing the Ceph messenger v2 protocol banner, the payloadlen field is decoded from the banner prefix. If a client sends a banner with a payloadlen of 0, the kernel sets up a 0-length...

Security update for the Linux Kernel

The SUSE Linux Enterprise 11 SP4 kernel was updated to fix various security issues: The following security issues were fixed: CVE-2026-46116: xfrm: defensively unhash xfrmstate lists in xfrmstatedelete bsc1267369. CVE-2026-52955: libceph: Fix potential out-of-bounds access in crushdecode...

SUSE CVE-2026-89656

In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crushdecode stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the decoded bucket id. A malformed map can therefore make one bucket...

SUSE CVE-2026-89657

In the Linux kernel, the following vulnerability has been resolved: libceph: validate OSD extent maps before cursor advance net/ceph/osdclient.c:osdsparseread validates that the sparse-read data length matches the summed extent lengths, but it does not validate that each OSD-supplied extent is...

Linux Distros Unpatched Vulnerability : CVE-2026-89657

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libceph: validate OSD extent maps before cursor advance net/ceph/osdclient.c:osdsparseread validates that the sparse-read data length matches the summed extent...

Linux Distros Unpatched Vulnerability : CVE-2026-89656

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libceph: reject buckets with mismatched CRUSH ids crushdecode stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from...

CVE-2026-89656

A flaw was found in libceph within the Linux kernel. This vulnerability allows a local attacker to craft a malformed CRUSH map, which is used for data placement. By doing so, one data bucket can be made to reuse another bucket's memory workspace, leading to an out-of-bounds write. This memory...

CVE-2026-89657

A flaw was found in libceph in the Linux kernel. A malicious or compromised authenticated Ceph Object Storage Device OSD peer could send a specially crafted sparse-read reply that lacks proper validation of extent maps. This could cause the client to advance its message-data cursor beyond the...