CVE-2026-23201

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-23201
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23201.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-23201
Downstream
BELL (1)
DEBIAN (1)
OESA (3)
openSUSE (1)
ROOT (2)
SUSE (9)
UBUNTU (1)
Related
openSUSE (1)
SUSE (9)
Published
2026-02-14T16:27:25Z
Modified
2026-10-20T10:30:51Z
Summary
ceph: fix oops due to invalid pointer for kfree() in parse_longname()
Details

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix oops due to invalid pointer for kfree() in parse_longname()

This fixes a kernel oops when reading ceph snapshot directories (.snap), for example by simply running ls /mnt/my_ceph/.snap.

The variable str is guarded by __free(kfree), but advanced by one for skipping the initial '_' in snapshot names. Thus, kfree() is called with an invalid pointer. This patch removes the need for advancing the pointer so kfree() is called with correct memory pointer.

Steps to reproduce:

  1. Create snapshots on a cephfs volume (I've 63 snaps in my testcase)

  2. Add cephfs mount to fstab $ echo "samba-fileserver@.files=/volumes/datapool/stuff/3461082b-ecc9-4e82-8549-3fd2590d3fb6 /mnt/test/stuff ceph acl,noatime,_netdev 0 0" >> /etc/fstab

  3. Reboot the system $ systemctl reboot

  4. Check if it's really mounted $ mount | grep stuff

  5. List snapshots (expected 63 snapshots on my system) $ ls /mnt/test/stuff/.snap

Now ls hangs forever and the kernel log shows the oops.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23201.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4b9aee707c4580511983a0998547f3b28514e6a6
Fixed
c9a129c82ddf82a50b4f8960d2609714ca2dbd26
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
bb80f7618832d26f7e395f52f82b1dac76223e5f
Fixed
8c9af7339de419819cfc641d551675d38ff99abf
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
101841c38346f4ca41dc1802c867da990ffb32eb
Fixed
e258ed369c9e04caa7d2fd49785d753ae4034cb6
Fixed
bc8dedae022ce3058659c3addef3ec4b41d15e00
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.12.42
Fixed
6.12.70
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.15.10
Fixed
6.16
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.16.1
Fixed
6.17
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
3145b2b11492d61c512bbc59660bb823bc757f48
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
493479af8af3ab907f49e99323777d498a4fbd2b

Affected versions

v6.*
v6.12.42
v6.12.43
v6.12.44
v6.12.45
v6.12.46
v6.12.47
v6.12.48
v6.12.49
v6.12.50
v6.12.51
v6.12.52
v6.12.53
v6.12.54
v6.12.55
v6.12.56
v6.12.57
v6.12.58
v6.12.59
v6.12.60
v6.12.61
v6.12.62
v6.12.63
v6.12.64
v6.12.65
v6.12.66
v6.12.67
v6.12.68
v6.12.69
v6.15.10
v6.15.11
v6.16.1
v6.16.10
v6.16.11
v6.16.12
v6.16.2
v6.16.3
v6.16.4
v6.16.5
v6.16.6
v6.16.7
v6.16.8
v6.16.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23201.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
6.12.70
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.10

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23201.json"