PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46024 Linux CVE debrief

A null pointer dereference vulnerability exists in the Linux kernel's libceph component within the ceph_handle_auth_reply() function. The flaw occurs when a CEPH_MSG_AUTH_REPLY message contains zero values for both protocol and result fields. Under specific conditions—when ac->negotiating is true and ac->protocol is greater than zero—the code sets ac->protocol to 0 and ac->ops to NULL. The existing check ac->protocol != protocol then evaluates to false, preventing init_protocol() from being called. Subsequently, ac->ops->handle_reply() is invoked on the NULL ac->ops pointer, causing a null pointer dereference. The fix changes the validation logic to !ac->protocol, which properly catches the zero-protocol case and treats such messages as containing a bad authentication protocol, preventing the unsafe dereference.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-16
Advisory published
2026-05-27
Advisory updated
2026-06-16

Who should care

Linux system administrators operating Ceph storage clusters; security teams monitoring kernel-level vulnerabilities in distributed storage infrastructure; organizations relying on Ceph for software-defined storage requiring authentication integrity

Technical summary

The vulnerability resides in net/ceph/auth.c in the ceph_handle_auth_reply() function. When processing CEPH_MSG_AUTH_REPLY messages, insufficient validation of zero-value protocol fields combined with specific state conditions (ac->negotiating == true, ac->protocol > 0) leads to NULL pointer dereference through ac->ops->handle_reply(). The fix modifies the protocol validation check from ac->protocol != protocol to !ac->protocol, ensuring zero-protocol messages are rejected as invalid before dereference occurs. Multiple stable kernel commits indicate backporting to affected versions.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the fix for CVE-2026-46024 when available from your Linux distribution
  • Monitor NVD for CVSS scoring and severity assignment as vulnerability analysis progresses
  • Review Ceph cluster authentication configurations for defense in depth
  • Validate kernel patch application through standard change management procedures

Evidence notes

Vulnerability description sourced from official CVE record and NVD entry. Patch commits identified in kernel.org stable repository. No CVSS score or severity rating currently assigned by NVD (status: Awaiting Analysis). No CISA KEV listing. Vendor attribution to Linux kernel based on source code references.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46024 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46024

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46024 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46024

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/016bc663657366d386993f63eb31072eb45a2b77

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4b2738b93edad661178340239de657d876b73d3d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5199c125d25aeae8615c4fc31652cc0fe624338e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8f2be7285941a33a9f72579a23b96392f83c758e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/927e4bd5692f2a4901808822981fb2c8d4456548

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.