Threats tagged 'ghsa-g5m7-8jmr-xx94'

CVE-2026-43407 is a critical vulnerability in the Linux kernel's libceph component involving a potential out-of-bounds memory access in the ceph_handle_auth_reply() function. The flaw arises from an integer overflow when the payload_len field is interpreted as a signed int, allowing a crafted CEPH_MSG_AUTH_REPLY message to cause memory corruption. The issue is fixed by changing payload_len and result_msg_len to unsigned 32-bit integers and adding sanity checks to ensure lengths do not exceed segment boundaries.