CVE-2026-43408 Linux CVE debrief

Who should care

Linux kernel maintainers, distribution security teams, and operators of systems that use the Ceph client on affected kernel builds should treat this as a priority patch item, especially in environments where local users can interact with Ceph-backed paths.

Technical summary

The bug is described as a missing zero-initialization requirement for ceph_path_info passed to ceph_mdsc_build_path(). If callers do not initialize the structure and the build path later fails, ceph_mdsc_free_path_info() may free or interpret stale fields, producing SLUB warnings, invalid frees, and kernel oopses. NVD classifies the issue as CWE-476 and assigns CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8).

Defensive priority

High. Patch affected kernels promptly, because the issue is reachable with local privileges and can cause reliable kernel instability; the reporter also flags possible broader impact if the bug is abused.

Recommended defensive actions

• Upgrade to a kernel build that includes the Ceph path-info initialization fix referenced by the official kernel patches.
• Inventory hosts running Linux kernel versions in the affected NVD ranges and prioritize systems with Ceph client usage.
• Backport or verify vendor patches on distribution kernels; confirm all ceph_mdsc_build_path() callers use zero-initialized ceph_path_info structures.
• Treat repeated SLUB warnings, ceph_open() crashes, or oopses involving ceph_mdsc_free_path_info() as indicators to patch immediately.
• Coordinate reboot windows after remediation so the fixed kernel is actually loaded on affected hosts.

Evidence notes

The source corpus shows the CVE record was published on 2026-05-08T15:16:52.397Z and modified on 2026-05-21T19:06:34.130Z. The NVD record lists affected Linux kernel ranges and a HIGH CVSS score, and the advisory text describes crash traces in kmem_cache_free() and __slab_free() when ceph_path_info is not zero-initialized. The official reference links in the corpus point to git.kernel.org stable patches. Exact fixed release versions are not stated in the supplied corpus, so remediation should follow the referenced upstream or vendor patches.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.