SUSE-SU-2026:5111-1

    Dashboard / Vulnerabilities / SUSE-SU-2026:5111-1

    SUSE-SU-2026:5111-1

    Published: 5 Nov 2026Last Modified: 5 Nov 2026

    Summary: Security update for cephfs

    Details: This update for cephfs fixes the following security issues: - CVE-2026-68160: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() (bsc#1275472). - CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446). - CVE-2026-52961: ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size (bsc#1269129). - CVE-2026-46052: ceph: only d_add() negative dentries when they are unhashed (bsc#1267494). - CVE-2026-52962: ceph: fix a buffer leak in __ceph_setxattr() (bsc#1269135). - CVE-2026-43420: ceph: fix i_nlink underrun during async unlink (bsc#1264814). - CVE-2026-43419: ceph: fix memory leaks in ceph_mdsc_build_path() (bsc#1264661). - CVE-2026-23201: ceph: fix oops due to invalid pointer for kfree() in parse_longname() (bsc#1258337). - CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403). - CVE-2025-38660: ceph: parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634). - ceph: validate snapdirname option length when mounting (git-fixes). - ceph: fix possible integer overflow in ceph_zero_objects() (git-fixes).

    References: https://www.suse.com/support/update/announcement/2026/suse-su-20265111-1/, https://bugzilla.suse.com/1248634, https://bugzilla.suse.com/1255403, https://bugzilla.suse.com/1258337, https://bugzilla.suse.com/1264446, https://bugzilla.suse.com/1264661, https://bugzilla.suse.com/1264814, https://bugzilla.suse.com/1267494, https://bugzilla.suse.com/1269129, https://bugzilla.suse.com/1269135, https://bugzilla.suse.com/1275472, https://www.suse.com/security/cve/CVE-2025-38660, https://www.suse.com/security/cve/CVE-2025-68297, https://www.suse.com/security/cve/CVE-2026-23201, https://www.suse.com/security/cve/CVE-2026-43273, https://www.suse.com/security/cve/CVE-2026-43419, https://www.suse.com/security/cve/CVE-2026-43420, https://www.suse.com/security/cve/CVE-2026-46052, https://www.suse.com/security/cve/CVE-2026-52961, https://www.suse.com/security/cve/CVE-2026-52962, https://www.suse.com/security/cve/CVE-2026-68160

    Affected packages

    Package

    Name: cephfs

    Purl: pkg:rpm/suse/cephfs&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Legacy%2015%20SP7

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.0-150700.15.7.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    SUSE-SU-2026:5111-1 | CVE-DB