CyberSecBulletin
CVE-2026-46119NVD status: Undergoing Analysis

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-46119 is a critical-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 9.1 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions c2374b92c729d0388a538b3cde7b3e3b5e55ef39, 38fdf04c602d52c42c67fc1617211492753b7e8b, 2ae0afd98432536562fa8261538ae795446f0589 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.53% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to c2374b92c729d0388a538b3cde7b3e3b5e55ef39 or 38fdf04c602d52c42c67fc1617211492753b7e8b or 2ae0afd98432536562fa8261538ae795446f0589 or 408e85ee708b6aa03eeb0220ffa0915f4d407181, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.15.209 or 6.1.175 or 6.6.140 or 6.12.88, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc up to, but not including, c2374b92c729d0388a538b3cde7b3e3b5e55ef39; 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc up to, but not including, 38fdf04c602d52c42c67fc1617211492753b7e8b; 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc up to, but not including, 2ae0afd98432536562fa8261538ae795446f0589; 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc up to, but not including, 408e85ee708b6aa03eeb0220ffa0915f4d407181; 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc up to, but not including, b7df9fbd4869fdfe09a3f501ffd228486521e062; 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc up to, but not including, 8517b6c8d2c759918ba0058cb6c7e14d59643202; 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc up to, but not including, 1c439de70b1c3eb3c6bffa8245c16b9fc318f114; 2.6.34c2374b92c729d0388a538b3cde7b3e3b5e55ef39, 38fdf04c602d52c42c67fc1617211492753b7e8b, 2ae0afd98432536562fa8261538ae795446f0589, 408e85ee708b6aa03eeb0220ffa0915f4d407181, b7df9fbd4869fdfe09a3f501ffd228486521e062, 8517b6c8d2c759918ba0058cb6c7e14d59643202
LinuxLinux Kernel2.6.34.1 up to, but not including, 5.15.209; 5.16 up to, but not including, 6.1.175; 6.2 up to, but not including, 6.6.140; 6.7 up to, but not including, 6.12.88; 6.13 up to, but not including, 6.18.30; 6.19 up to, but not including, 7.0.7; 2.6.345.15.209, 6.1.175, 6.6.140, 6.12.88, 6.18.30, 7.0.7

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix slab-out-of-bounds access in auth message processing If a (potentially corrupted) message of type CEPH_MSG_AUTH_REPLY contains a positive value in its result field, it is treated as an error code by ceph_handle_auth_reply() and returned to handle_auth_reply(). Thereafter, an attempt is made to send the preallocated message of type CEPH_MSG_AUTH, where the returned value is interpreted as the size of the front segment to send. If the result value in the message is greater than the size of the memory buffer allocated for the front segment, an out-of-bounds access occurs, and the content of the memory region beyond this buffer is sent out. This patch fixes the issue by treating only negative values in the result field as errors. Positive values are therefore treated as success in the same way as a zero value. Additionally, a BUG_ON is added to __send_prepared_auth_request() comparing the len parameter to front_alloc_len to prevent sending the message if it exceeds the bounds of the allocation and to make it easier to catch any logic flaws leading to this.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.