Answer in brief
CVE-2026-43304 records a Unknown severity vulnerability in libceph: define and enforce CEPH_MAX_KEY_LEN. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=cd1a677cad994021b19665ed476aea63f5d54f31 <6405e8c680974bb74e2c98d5249fb52c7b12a6c6 || >=cd1a677cad994021b19665ed476aea63f5d54f31 <8d745d38c88ecbed95f6b2b39857bf89f35a3244 || >=cd1a677cad994021b19665ed476aea63f5d54f31 <e1dc45d97975f9db65694d234fbddf1915176e16 || >=cd1a677cad994021b19665ed476aea63f5d54f31 <1b275bd49e58752efb83767a5d1aed41356c5e64 || >=cd1a677cad994021b19665ed476aea63f5d54f31 <c1a0f5f1e5e7e98c36a362ec3d1fcfd9932931ed || >=cd1a677cad994021b19665ed476aea63f5d54f31 <d82467c07b03a27c3c5469b62bb3b726305a80bb || >=cd1a677cad994021b19665ed476aea63f5d54f31 <ac431d597a9bdfc2ba6b314813f29a6ef2b4a3bf | 6405e8c680974bb74e2c98d5249fb52c7b12a6c6, 8d745d38c88ecbed95f6b2b39857bf89f35a3244, e1dc45d97975f9db65694d234fbddf1915176e16, 1b275bd49e58752efb83767a5d1aed41356c5e64, c1a0f5f1e5e7e98c36a362ec3d1fcfd9932931ed, d82467c07b03a27c3c5469b62bb3b726305a80bb, ac431d597a9bdfc2ba6b314813f29a6ef2b4a3bf |
| Linux/Linuxgeneric | 5.11 | Not reported |
Published upstream
May 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: libceph: define and enforce CEPH_MAX_KEY_LEN When decoding the key, verify that the key material would fit into a fixed-size buffer in process_auth_done() and generally has a sane length. The new CEPH_MAX_KEY_LEN check replaces the existing check for a key with no key material which is a) not universal since CEPH_CRYPTO_NONE has to be excluded and b) doesn't provide much value since a smaller than needed key is just as invalid as no key -- this has to be handled elsewhere anyway.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-43304 records a Unknown severity vulnerability in libceph: define and enforce CEPH_MAX_KEY_LEN. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=cd1a677cad994021b19665ed476aea63f5d54f31 <6405e8c680974bb74e2c98d5249fb52c7b12a6c6 || >=cd1a677cad994021b19665ed476aea63f5d54f31 <8d745d38c88ecbed95f6b2b39857bf89f35a3244 || >=cd1a677cad994021b19665ed476aea63f5d54f31 <e1dc45d97975f9db65694d234fbddf1915176e16 || >=cd1a677cad994021b19665ed476aea63f5d54f31 <1b275bd49e58752efb83767a5d1aed41356c5e64 || >=cd1a677cad994021b19665ed476aea63f5d54f31 <c1a0f5f1e5e7e98c36a362ec3d1fcfd9932931ed || >=cd1a677cad994021b19665ed476aea63f5d54f31 <d82467c07b03a27c3c5469b62bb3b726305a80bb || >=cd1a677cad994021b19665ed476aea63f5d54f31 <ac431d597a9bdfc2ba6b314813f29a6ef2b4a3bf | 6405e8c680974bb74e2c98d5249fb52c7b12a6c6, 8d745d38c88ecbed95f6b2b39857bf89f35a3244, e1dc45d97975f9db65694d234fbddf1915176e16, 1b275bd49e58752efb83767a5d1aed41356c5e64, c1a0f5f1e5e7e98c36a362ec3d1fcfd9932931ed, d82467c07b03a27c3c5469b62bb3b726305a80bb, ac431d597a9bdfc2ba6b314813f29a6ef2b4a3bf |
| Linux/Linuxgeneric | 5.11 | Not reported |
Published upstream
May 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: libceph: define and enforce CEPH_MAX_KEY_LEN When decoding the key, verify that the key material would fit into a fixed-size buffer in process_auth_done() and generally has a sane length. The new CEPH_MAX_KEY_LEN check replaces the existing check for a key with no key material which is a) not universal since CEPH_CRYPTO_NONE has to be excluded and b) doesn't provide much value since a smaller than needed key is just as invalid as no key -- this has to be handled elsewhere anyway.
Quoted source text, attributed separately from HOL analysis.