SB20260508126 - Improper Initialization in Linux kernel ceph

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Initialization (CVE-ID: CVE-2026-43408)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in ceph_mdsc_build_path() callers when handling error paths after building Ceph path information. A local user can trigger a failed ceph_mdsc_build_path() call and subsequent ceph_mdsc_free_path_info() use of an uninitialized ceph_path_info structure to cause a denial of service.

The issue may occur because ceph_mdsc_build_path() initializes the structure only on success, while callers may still free it after an error.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/43323a5934b660afae687e8e4e95ac328615a5c4
• https://git.kernel.org/stable/c/453df1f4535842bf17ff1885a225e153d7ee3374
• https://git.kernel.org/stable/c/644b47f0574fd82aeb9d00317eca8d1f2a525c8c
• https://git.kernel.org/stable/c/8be8911f590813e6f90bc6407ced1b23e50bc5da