cve-2026-23201

{
  "cvss": 5.5,
  "datePublished": "2026-02-14T17:15:57.950",
  "dateUpdated": "2026-09-14T12:17:39.287",
  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix oops due to invalid pointer for kfree() in parse_longname()\n\nThis fixes a kernel oops when reading ceph snapshot directories (.snap),\nfor example by simply running `ls /mnt/my_ceph/.snap`.\n\nThe variable str is guarded by __free(kfree), but advanced by one for\nskipping the initial '_' in snapshot names. Thus, kfree() is called\nwith an invalid pointer.  This patch removes the need for advancing the\npointer so kfree() is called with correct memory pointer.\n\nSteps to reproduce:\n\n1. Create snapshots on a cephfs volume (I've 63 snaps in my testcase)\n\n2. Add cephfs mount to fstab\n$ echo \"samba-fileserver@.files=/volumes/datapool/stuff/3461082b-ecc9-4e82-8549-3fd2590d3fb6      /mnt/test/stuff   ceph     acl,noatime,_netdev    0       0\" >> /etc/fstab\n\n3. Reboot the system\n$ systemctl reboot\n\n4. Check if it's really mounted\n$ mount | grep stuff\n\n5. List snapshots (expected 63 snapshots on my system)\n$ ls /mnt/test/stuff/.snap\n\nNow ls hangs forever and the kernel log shows the oops.",
  "id": "CVE-2026-23201",
  "raw": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Linux",
            "programFiles": [
              "fs/ceph/crypto.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "lessThan": "c9a129c82ddf82a50b4f8960d2609714ca2dbd26",
                "status": "affected",
                "version": "4b9aee707c4580511983a0998547f3b28514e6a6",
                "versionType": "git"
              },
              {
                "lessThan": "8c9af7339de419819cfc641d551675d38ff99abf",
                "status": "affected",
                "version": "bb80f7618832d26f7e395f52f82b1dac76223e5f",
                "versionType": "git"
              },
              {
                "lessThan": "e258ed369c9e04caa7d2fd49785d753ae4034cb6",
                "status": "affected",
                "version": "101841c38346f4ca41dc1802c867da990ffb32eb",
                "versionType": "git"
              },
              {
                "lessThan": "bc8dedae022ce3058659c3addef3ec4b41d15e00",
                "status": "affected",
                "version": "101841c38346f4ca41dc1802c867da990ffb32eb",
                "versionType": "git"
              },
              {
                "status": "affected",
                "version": "3145b2b11492d61c512bbc59660bb823bc757f48",
                "versionType": "git"
              },
              {
                "status": "affected",
                "version": "493479af8af3ab907f49e99323777d498a4fbd2b",
                "versionType": "git"
              },
              {
                "lessThan": "6.12.70",
                "status": "affected",
                "version": "6.12.42",
                "versionType": "semver"
              },
              {
                "lessThan": "6.16",
                "status": "affected",
                "version": "6.15.10",
                "versionType": "semver"
              },
              {
                "lessThan": "6.17",
                "status": "affected",
                "version": "6.16.1",
                "versionType": "semver"
              }
            ]
          },
          {
            "defaultStatus": "affected",
            "product": "Linux",
            "programFiles": [
              "fs/ceph/crypto.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "status": "affected",
                "version": "6.17"
              },
              {
                "lessThan": "6.17",
                "status": "unaffected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.12.*",
                "status": "unaffected",
                "version": "6.12.70",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.18.*",
                "status": "unaffected",
                "version": "6.18.10",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "6.19",
                "versionType": "original_commit_for_fix"
              }
            ]
          }
        ],
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "4E35130D-49A4-4F25-AFAF-52726A775239",
                "versionEndExcluding": "6.12.70",
                "versionStartIncluding": "6.12.42",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "8E12C24E-0833-48D3-9A8D-574823A693F0",
                "versionEndExcluding": "6.16",
                "versionStartIncluding": "6.15.10",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "496F2923-911F-4FFD-B9A0-4B9D70EBA1C4",
                "versionEndExcluding": "6.18.10",
                "versionStartIncluding": "6.16.1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*",
                "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*",
                "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*",
                "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*",
                "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*",
                "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*",
                "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*",
                "matchCriteriaId": "F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*",
                "matchCriteriaId": "EB5B7DFC-C36B-45D8-922C-877569FDDF43",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix oops due to invalid pointer for kfree() in parse_longname()\n\nThis fixes a kernel oops when reading ceph snapshot directories (.snap),\nfor example by simply running `ls /mnt/my_ceph/.snap`.\n\nThe variable str is guarded by __free(kfree), but advanced by one for\nskipping the initial '_' in snapshot names. Thus, kfree() is called\nwith an invalid pointer.  This patch removes the need for advancing the\npointer so kfree() is called with correct memory pointer.\n\nSteps to reproduce:\n\n1. Create snapshots on a cephfs volume (I've 63 snaps in my testcase)\n\n2. Add cephfs mount to fstab\n$ echo \"samba-fileserver@.files=/volumes/datapool/stuff/3461082b-ecc9-4e82-8549-3fd2590d3fb6      /mnt/test/stuff   ceph     acl,noatime,_netdev    0       0\" >> /etc/fstab\n\n3. Reboot the system\n$ systemctl reboot\n\n4. Check if it's really mounted\n$ mount | grep stuff\n\n5. List snapshots (expected 63 snapshots on my system)\n$ ls /mnt/test/stuff/.snap\n\nNow ls hangs forever and the kernel log shows the oops."
      },
      {
        "lang": "es",
        "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nceph: corrige un oops debido a un puntero inválido para kfree() en parse_longname()\n\nEsto corrige un oops del kernel al leer directorios de instantáneas de ceph (.snap), por ejemplo, simplemente ejecutando 'ls /mnt/my_ceph/.snap'.\n\nLa variable str está protegida por __free(kfree), pero se avanza en uno para saltar el '_' inicial en los nombres de las instantáneas. Por lo tanto, se llama a kfree() con un puntero inválido. Este parche elimina la necesidad de avanzar el puntero para que se llame a kfree() con el puntero de memoria correcto.\n\nPasos para reproducir:\n\n1. Crea instantáneas en un volumen cephfs (tengo 63 instantáneas en mi caso de prueba)\n\n2. Añade el montaje cephfs a fstab\n$ echo 'samba-fileserver@.files=/volumes/datapool/stuff/3461082b-ecc9-4e82-8549-3fd2590d3fb6      /mnt/test/stuff   ceph     acl,noatime,_netdev    0       0' >> /etc/fstab\n\n3. Reinicia el sistema\n$ systemctl reboot\n\n4. Comprueba si está realmente montado\n$ mount | grep stuff\n\n5. Lista las instantáneas (se esperan 63 instantáneas en mi sistema)\n$ ls /mnt/test/stuff/.snap\n\nAhora ls se cuelga indefinidamente y el registro del kernel muestra el oops."
      }
    ],
    "id": "CVE-2026-23201",
    "lastModified": "2026-09-14T12:17:39.287",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 3.6,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "published": "2026-02-14T17:15:57.950",
    "references": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/8c9af7339de419819cfc641d551675d38ff99abf"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/bc8dedae022ce3058659c3addef3ec4b41d15e00"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/c9a129c82ddf82a50b4f8960d2609714ca2dbd26"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/e258ed369c9e04caa7d2fd49785d753ae4034cb6"
      }
    ],
    "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-476"
          }
        ],
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "severity": "MEDIUM",
  "source": "nvd",
  "title": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix oops due to invalid pointer for kfree(..."
}