CVE-2026-68156

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> libceph: refresh auth-&gt;authorizer_buf{,_len} after authorizer update<br /> <br /> ceph_x_create_authorizer() caches au-&gt;buf-&gt;vec.iov_base and<br /> au-&gt;buf-&gt;vec.iov_len in struct ceph_auth_handshake. These<br /> cached values are then used by the messenger connect code when<br /> sending the authorizer.<br /> <br /> ceph_x_update_authorizer() can rebuild the authorizer when a newer<br /> service ticket is available. If the rebuilt authorizer no longer<br /> fits in the existing buffer, ceph_x_build_authorizer() drops its<br /> reference to au-&gt;buf and allocates a new one. If this is the final<br /> reference, ceph_buffer_put() frees the old ceph_buffer and its<br /> vec.iov_base, but auth-&gt;authorizer_buf still points at that freed<br /> memory.<br /> <br /> A subsequent msgr1 reconnect can therefore queue the stale pointer<br /> and trigger a KASAN slab-use-after-free in _copy_from_iter() while<br /> tcp_sendmsg() copies the authorizer.<br /> <br /> Refresh auth-&gt;authorizer_buf and auth-&gt;authorizer_buf_len after a<br /> successful authorizer rebuild so the messenger sends the current<br /> buffer.