CVE-2026-46024

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()<br /> <br /> If a message of type CEPH_MSG_AUTH_REPLY contains a zero value for both<br /> protocol and result, this is currently not treated as an error. In case<br /> of ac-&gt;negotiating == true and ac-&gt;protocol &gt; 0, this leads to setting<br /> ac-&gt;protocol = 0 and ac-&gt;ops = NULL. Thereafter, the check for<br /> ac-&gt;protocol != protocol returns false, and init_protocol() is not<br /> called. Subsequently, ac-&gt;ops-&gt;handle_reply() is called, which leads to<br /> a null pointer dereference, because ac-&gt;ops is still NULL.<br /> <br /> This patch changes the check for ac-&gt;protocol != protocol to<br /> !ac-&gt;protocol, as this also includes the case when the protocol was set<br /> to zero in the message. This causes the message to be treated as<br /> containing a bad auth protocol.