CVE-2026-23189

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix NULL pointer dereference in ceph_mds_auth_match()

The CephFS kernel client has regression starting from 6.18-rc1.

We have issue in ceph_mds_auth_match() if fs_name == NULL:

const char fs_name = mdsc->fsc->mount_options->mds_namespace;

...

if (auth->match.fs_name && strcmp(auth->match.fs_name, fs_name)) {

/ fsname mismatch, try next one */

return 0;

}

Patrick Donnelly suggested that: In summary, we should definitely start

decoding `fs_name` from the MDSMap and do strict authorizations checks

against it. Note that the `-o mds_namespace=foo` should only be used for

selecting the file system to mount and nothing else. It's possible

no mds_namespace is specified but the kernel will mount the only

file system that exists which may have name "foo".

This patch reworks ceph_mdsmap_decode() and namespace_equals() with

the goal of supporting the suggested concept. Now struct

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References