GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-23189 (GCVE-0-2026-23189)

Vulnerability from cvelistv5 – Published: 2026-02-14 16:27 – Updated: 2026-05-23 16:04
VLAI
Title
ceph: fix NULL pointer dereference in ceph_mds_auth_match()
Summary
In the Linux kernel, the following vulnerability has been resolved: ceph: fix NULL pointer dereference in ceph_mds_auth_match() The CephFS kernel client has regression starting from 6.18-rc1. We have issue in ceph_mds_auth_match() if fs_name == NULL: const char fs_name = mdsc->fsc->mount_options->mds_namespace; ... if (auth->match.fs_name && strcmp(auth->match.fs_name, fs_name)) { / fsname mismatch, try next one */ return 0; } Patrick Donnelly suggested that: In summary, we should definitely start decoding `fs_name` from the MDSMap and do strict authorizations checks against it. Note that the `-o mds_namespace=foo` should only be used for selecting the file system to mount and nothing else. It's possible no mds_namespace is specified but the kernel will mount the only file system that exists which may have name "foo". This patch reworks ceph_mdsmap_decode() and namespace_equals() with the goal of supporting the suggested concept. Now struct ceph_mdsmap contains m_fs_name field that receives copy of extracted FS name by ceph_extract_encoded_string(). For the case of "old" CephFS file systems, it is used "cephfs" name. [ idryomov: replace redundant %*pE with %s in ceph_mdsmap_decode(), get rid of a series of strlen() calls in ceph_namespace_match(), drop changes to namespace_equals() body to avoid treating empty mds_namespace as equal, drop changes to ceph_mdsc_handle_fsmap() as namespace_equals() isn't an equivalent substitution there ]
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 07640d34a781bb2e39020a39137073c03c4aa932 , < c6f8326f26bd20d648d9a55afd68148d1b6afe28 (git)
Affected: 22c73d52a6d05c5a2053385c0d6cd9984732799d , < 57b36ffc8881dd455d875f85c105901974af2130 (git)
Affected: 22c73d52a6d05c5a2053385c0d6cd9984732799d , < 7987cce375ac8ce98e170a77aa2399f2cf6eb99f (git)
Affected: ca3da8b27ab9a0923ad477447cfb8fc7f4b4c523 (git)
Affected: 6.12.58 , < 6.12.70 (semver)
Affected: 6.17.8 , < 6.18 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.12.70 , ≤ 6.12.* (semver)
Unaffected: 6.18.10 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/mds_client.c",
            "fs/ceph/mdsmap.c",
            "fs/ceph/mdsmap.h",
            "fs/ceph/super.h",
            "include/linux/ceph/ceph_fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c6f8326f26bd20d648d9a55afd68148d1b6afe28",
              "status": "affected",
              "version": "07640d34a781bb2e39020a39137073c03c4aa932",
              "versionType": "git"
            },
            {
              "lessThan": "57b36ffc8881dd455d875f85c105901974af2130",
              "status": "affected",
              "version": "22c73d52a6d05c5a2053385c0d6cd9984732799d",
              "versionType": "git"
            },
            {
              "lessThan": "7987cce375ac8ce98e170a77aa2399f2cf6eb99f",
              "status": "affected",
              "version": "22c73d52a6d05c5a2053385c0d6cd9984732799d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ca3da8b27ab9a0923ad477447cfb8fc7f4b4c523",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.70",
              "status": "affected",
              "version": "6.12.58",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18",
              "status": "affected",
              "version": "6.17.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/mds_client.c",
            "fs/ceph/mdsmap.c",
            "fs/ceph/mdsmap.h",
            "fs/ceph/super.h",
            "include/linux/ceph/ceph_fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.70",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.70",
                  "versionStartIncluding": "6.12.58",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.10",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.17.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix NULL pointer dereference in ceph_mds_auth_match()\n\nThe CephFS kernel client has regression starting from 6.18-rc1.\nWe have issue in ceph_mds_auth_match() if fs_name == NULL:\n\n    const char fs_name = mdsc-\u003efsc-\u003emount_options-\u003emds_namespace;\n    ...\n    if (auth-\u003ematch.fs_name \u0026\u0026 strcmp(auth-\u003ematch.fs_name, fs_name)) {\n            / fsname mismatch, try next one */\n            return 0;\n    }\n\nPatrick Donnelly suggested that: In summary, we should definitely start\ndecoding `fs_name` from the MDSMap and do strict authorizations checks\nagainst it. Note that the `-o mds_namespace=foo` should only be used for\nselecting the file system to mount and nothing else. It\u0027s possible\nno mds_namespace is specified but the kernel will mount the only\nfile system that exists which may have name \"foo\".\n\nThis patch reworks ceph_mdsmap_decode() and namespace_equals() with\nthe goal of supporting the suggested concept. Now struct ceph_mdsmap\ncontains m_fs_name field that receives copy of extracted FS name\nby ceph_extract_encoded_string(). For the case of \"old\" CephFS file\nsystems, it is used \"cephfs\" name.\n\n[ idryomov: replace redundant %*pE with %s in ceph_mdsmap_decode(),\n  get rid of a series of strlen() calls in ceph_namespace_match(),\n  drop changes to namespace_equals() body to avoid treating empty\n  mds_namespace as equal, drop changes to ceph_mdsc_handle_fsmap()\n  as namespace_equals() isn\u0027t an equivalent substitution there ]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T16:04:05.037Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c6f8326f26bd20d648d9a55afd68148d1b6afe28"
        },
        {
          "url": "https://git.kernel.org/stable/c/57b36ffc8881dd455d875f85c105901974af2130"
        },
        {
          "url": "https://git.kernel.org/stable/c/7987cce375ac8ce98e170a77aa2399f2cf6eb99f"
        }
      ],
      "title": "ceph: fix NULL pointer dereference in ceph_mds_auth_match()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23189",
    "datePublished": "2026-02-14T16:27:17.549Z",
    "dateReserved": "2026-01-13T15:37:45.985Z",
    "dateUpdated": "2026-05-23T16:04:05.037Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23189",
      "date": "2026-09-16",
      "epss": "0.00117",
      "percentile": "0.01874"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23189\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-02-14T17:15:56.703\",\"lastModified\":\"2026-06-17T10:21:03.920\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nceph: fix NULL pointer dereference in ceph_mds_auth_match()\\n\\nThe CephFS kernel client has regression starting from 6.18-rc1.\\nWe have issue in ceph_mds_auth_match() if fs_name == NULL:\\n\\n    const char fs_name = mdsc-\u003efsc-\u003emount_options-\u003emds_namespace;\\n    ...\\n    if (auth-\u003ematch.fs_name \u0026\u0026 strcmp(auth-\u003ematch.fs_name, fs_name)) {\\n            / fsname mismatch, try next one */\\n            return 0;\\n    }\\n\\nPatrick Donnelly suggested that: In summary, we should definitely start\\ndecoding `fs_name` from the MDSMap and do strict authorizations checks\\nagainst it. Note that the `-o mds_namespace=foo` should only be used for\\nselecting the file system to mount and nothing else. It\u0027s possible\\nno mds_namespace is specified but the kernel will mount the only\\nfile system that exists which may have name \\\"foo\\\".\\n\\nThis patch reworks ceph_mdsmap_decode() and namespace_equals() with\\nthe goal of supporting the suggested concept. Now struct ceph_mdsmap\\ncontains m_fs_name field that receives copy of extracted FS name\\nby ceph_extract_encoded_string(). For the case of \\\"old\\\" CephFS file\\nsystems, it is used \\\"cephfs\\\" name.\\n\\n[ idryomov: replace redundant %*pE with %s in ceph_mdsmap_decode(),\\n  get rid of a series of strlen() calls in ceph_namespace_match(),\\n  drop changes to namespace_equals() body to avoid treating empty\\n  mds_namespace as equal, drop changes to ceph_mdsc_handle_fsmap()\\n  as namespace_equals() isn\u0027t an equivalent substitution there ]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nceph: soluciona la desreferencia de puntero NULL en ceph_mds_auth_match()\\n\\nEl cliente del kernel de CephFS tiene una regresi\u00f3n a partir de 6.18-rc1.\\nTenemos un problema en ceph_mds_auth_match() si fs_name == NULL:\\n\\n    const char fs_name = mdsc-\u0026gt;fsc-\u0026gt;mount_options-\u0026gt;mds_namespace;\\n    ...\\n    if (auth-\u0026gt;match.fs_name \u0026amp;\u0026amp; strcmp(auth-\u0026gt;match.fs_name, fs_name)) {\\n            / el nombre de sistema de archivos no coincide, intentar el siguiente */\\n            return 0;\\n    }\\n\\nPatrick Donnelly sugiri\u00f3 que: En resumen, definitivamente deber\u00edamos empezar a decodificar \u0027fs_name\u0027 del MDSMap y realizar controles de autorizaci\u00f3n estrictos contra \u00e9l. Tenga en cuenta que \u0027-o mds_namespace=foo\u0027 solo debe usarse para seleccionar el sistema de archivos a montar y nada m\u00e1s. Es posible que no se especifique ning\u00fan mds_namespace, pero el kernel montar\u00e1 el \u00fanico sistema de archivos que existe, el cual puede tener el nombre \u0027foo\u0027.\\n\\nEste parche reelabora ceph_mdsmap_decode() y namespace_equals() con el objetivo de apoyar el concepto sugerido. Ahora la estructura ceph_mdsmap contiene el campo m_fs_name que recibe una copia del nombre de FS extra\u00eddo por ceph_extract_encoded_string(). Para el caso de sistemas de archivos CephFS \u0027antiguos\u0027, se utiliza el nombre \u0027cephfs\u0027.\\n\\n[ idryomov: reemplazar el redundante %*pE con %s en ceph_mdsmap_decode(), eliminar una serie de llamadas a strlen() en ceph_namespace_match(), descartar cambios en el cuerpo de namespace_equals() para evitar tratar un mds_namespace vac\u00edo como igual, descartar cambios en ceph_mdsc_handle_fsmap() ya que namespace_equals() no es una sustituci\u00f3n equivalente all\u00ed ]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ceph/mds_client.c\",\"fs/ceph/mdsmap.c\",\"fs/ceph/mdsmap.h\",\"fs/ceph/super.h\",\"include/linux/ceph/ceph_fs.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"07640d34a781bb2e39020a39137073c03c4aa932\",\"lessThan\":\"c6f8326f26bd20d648d9a55afd68148d1b6afe28\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"22c73d52a6d05c5a2053385c0d6cd9984732799d\",\"lessThan\":\"57b36ffc8881dd455d875f85c105901974af2130\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"22c73d52a6d05c5a2053385c0d6cd9984732799d\",\"lessThan\":\"7987cce375ac8ce98e170a77aa2399f2cf6eb99f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ca3da8b27ab9a0923ad477447cfb8fc7f4b4c523\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.12.58\",\"lessThan\":\"6.12.70\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.17.8\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ceph/mds_client.c\",\"fs/ceph/mdsmap.c\",\"fs/ceph/mdsmap.h\",\"fs/ceph/super.h\",\"include/linux/ceph/ceph_fs.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.70\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.10\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12.58\",\"versionEndExcluding\":\"6.12.70\",\"matchCriteriaId\":\"ACE64C6D-2601-447E-8A2B-0D932A7C5C60\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.17.8\",\"versionEndExcluding\":\"6.18.10\",\"matchCriteriaId\":\"6B6161FA-39A8-4DBD-9D3F-130200A2D241\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"17B67AA7-40D6-4AFA-8459-F200F3D7CFD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C47E4CC9-C826-4FA9-B014-7FE3D9B318B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F71D92C0-C023-48BD-B3B6-70B638EEE298\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"13580667-0A98-40CC-B29F-D12790B91BDB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3EF854A1-ABB1-4E93-BE9A-44569EC76C0D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB5B7DFC-C36B-45D8-922C-877569FDDF43\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/57b36ffc8881dd455d875f85c105901974af2130\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7987cce375ac8ce98e170a77aa2399f2cf6eb99f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c6f8326f26bd20d648d9a55afd68148d1b6afe28\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T07:19:21+00:00",
      "cve": "CVE-2026-23189",
      "id": "CVE-2026-23189",
      "initial_release_date": "2026-02-14T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ceph: fix NULL pointer dereference in ceph_mds_auth_match()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23189.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.