CVE-2026-23189: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23189 is a NULL pointer dereference vulnerability in the Linux kernel's CephFS client, specifically in the ceph_mds_auth_match() function. The flaw is a regression introduced starting from kernel version 6.18-rc1, triggered when fs_name is NULL during MDS (Metadata Server) authentication namespace matching. Affected versions include Linux kernel 6.12.58–6.12.69, 6.17.8–6.18.9, and 6.19-rc1 through 6.19-rc8. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a NULL pointer dereference (CWE-476) in ceph_mds_auth_match(), where the code attempts to call strcmp(auth->match.fs_name, fs_name) without first validating that fs_name (derived from mdsc->fsc->mount_options->mds_namespace) is non-NULL. The fix reworks ceph_mdsmap_decode() and namespace_equals() to extract the filesystem name from the MDSMap into a new m_fs_name field in struct ceph_mdsmap, using ceph_extract_encoded_string(), and defaults to "cephfs" for legacy CephFS filesystems. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction, making it exploitable by any local user on a system mounting a CephFS filesystem (Feedly, Kernel Patch 1).

Successful exploitation causes a kernel panic or system crash, resulting in a denial-of-service (DoS) condition with high availability impact. There is no confidentiality or integrity impact. The vulnerability affects any Linux system running a CephFS-mounted filesystem on a vulnerable kernel version, and a local low-privileged user can crash the entire system, affecting all co-located workloads and services (Feedly).

• Logs: Kernel oops or panic messages in /var/log/kern.log or dmesg referencing ceph_mds_auth_match, ceph_mdsmap_decode, or a NULL pointer dereference in the ceph kernel module.
• Process/System: Unexpected system reboots or kernel crashes on hosts with active CephFS mounts; kdump crash dumps referencing the ceph.ko module.
• File System: Presence of crash dump files (e.g., /var/crash/) generated around the time of CephFS mount or authentication operations.

Update the Linux kernel to a patched version: 6.12.70 or later, 6.18.10 or later, or a patched 6.19-rc release. Three upstream commits address the issue: 57b36ffc8881, 7987cce375ac, and c6f8326f26bd (Kernel Patch 1, Kernel Patch 2, Kernel Patch 3). Debian and Oracle Linux have issued advisories with updated kernel packages. As an interim workaround, restrict local user access on systems running CephFS mounts and monitor for kernel crash events (Feedly, Debian Advisory).

Debian issued a security advisory (DSA-6141-1) covering this vulnerability among other kernel fixes, and Oracle Linux released corresponding errata (ELSA-2026-50160 and ELSA-2026-50232). No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking and distribution advisories (Debian Advisory, Oracle Advisory).