Linux Kernel CEHFS Oops via Invalid kfree() in parse_longname()
CVE-2026-23201 Published on February 14, 2026
ceph: fix oops due to invalid pointer for kfree() in parse_longname()
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix oops due to invalid pointer for kfree() in parse_longname()
This fixes a kernel oops when reading ceph snapshot directories (.snap),
for example by simply running `ls /mnt/my_ceph/.snap`.
The variable str is guarded by __free(kfree), but advanced by one for
skipping the initial '_' in snapshot names. Thus, kfree() is called
with an invalid pointer. This patch removes the need for advancing the
pointer so kfree() is called with correct memory pointer.
Steps to reproduce:
1. Create snapshots on a cephfs volume (I've 63 snaps in my testcase)
2. Add cephfs mount to fstab
$ echo "samba-fileserver@.files=/volumes/datapool/stuff/3461082b-ecc9-4e82-8549-3fd2590d3fb6 /mnt/test/stuff ceph acl,noatime,_netdev 0 0" >> /etc/fstab
3. Reboot the system
$ systemctl reboot
4. Check if it's really mounted
$ mount | grep stuff
5. List snapshots (expected 63 snapshots on my system)
$ ls /mnt/test/stuff/.snap
Now ls hangs forever and the kernel log shows the oops.
Products Associated with CVE-2026-23201
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-23201 are published in Linux Kernel:
Affected Versions
Linux:- Version bb80f7618832d26f7e395f52f82b1dac76223e5f and below 8c9af7339de419819cfc641d551675d38ff99abf is affected.
- Version 101841c38346f4ca41dc1802c867da990ffb32eb and below e258ed369c9e04caa7d2fd49785d753ae4034cb6 is affected.
- Version 101841c38346f4ca41dc1802c867da990ffb32eb and below bc8dedae022ce3058659c3addef3ec4b41d15e00 is affected.
- Version 3145b2b11492d61c512bbc59660bb823bc757f48 is affected.
- Version 493479af8af3ab907f49e99323777d498a4fbd2b is affected.
- Version 6.17 is affected.
- Before 6.17 is unaffected.
- Version 6.12.70, <= 6.12.* is unaffected.
- Version 6.18.10, <= 6.18.* is unaffected.
- Version 6.19, <= * is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.