CVE-2026-43405 Linux CVE debrief

Who should care

Linux kernel maintainers, distribution security teams, and operators of systems that use the kernel Ceph client/libceph paths on affected kernel releases should prioritize this CVE.

Technical summary

The kernel function ceph_monmap_decode() used signed int variables for blob_len and num_mon even though the decoded values are non-negative u32 inputs. NVD states that a very large incoming num_mon value can be interpreted as negative, allowing the num_mon > CEPH_MAX_MON validation to fail open. The result is an attempted allocation of an excessively large monmap, which will likely fail and return -ENOMEM instead of the expected -EINVAL. NVD classifies the weakness as CWE-908.

Defensive priority

High for any environment running affected Linux kernel branches with Ceph/libceph enabled. The fix is a small parser/type correction, but the exposure is remote and the official severity is high.

Recommended defensive actions

• Apply the stable kernel updates or patches linked in the official NVD references for the affected branches.
• Confirm whether your fleet uses the kernel Ceph/libceph code path; if not, still patch according to your normal kernel maintenance policy.
• Prioritize remediation on systems that may receive untrusted or less-trusted Ceph-related network traffic.
• Use the affected-version ranges from NVD to map exposure across supported branches before scheduling maintenance.

Evidence notes

CVE-2026-43405 was published in the official record on 2026-05-08 and last modified on 2026-05-21. The NVD record lists CVSS 3.1 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H and CWE-908. The NVD CPE criteria mark Linux kernel ranges starting at 5.11, 5.16, 6.2, 6.7, 6.13, 6.19, and 7.0 rc1-rc3 as vulnerable up to the specified fixed versions. The supplied description says the bug is caused by signedness changes in blob_len and num_mon during ceph_monmap_decode(), which can let a very large num_mon evade the max-mon check and trigger an unnecessary large allocation attempt.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.