In the Linux kernel, the following vulnerability has been resolved: ceph: properly decrypt filenames in vmalloc() buffers The fscrypt subsystem uses the scatterlist crypto API, inheriting its requirement that any buffers are in the linear mapping region. However, the messenger client uses kvmalloc() to create buffers for messages, which will occasionally place those buffers in the vmalloc() region when physical memory fragmentation doesn't permit a large enough kmalloc(). The various callers of ceph_fname_to_usr() directly pass (slices of) raw messages from the MDS without considering that the messages may be in vmalloc() buffers, resulting in oopses especially on non-x86 platforms (see 'Closes:' for more details and a reproducer). Make ceph_fname_to_usr() explicitly tolerant of vmalloc()-allocated fname->ctext, fname->name, and/or oname->name buffers, using `tname` (which, when non-null, must be a linear address; when null, is briefly allocated as necessary) as a bounce buffer to avoid passing any inappropriate addresses to fscrypt_fname_disk_to_usr(). Additionally change parse_reply_info_readdir() -- the only function to supply its own `tname` -- to follow the new "tname must never come from vmalloc()" rule by passing NULL when the message is not in the linear region. Though this causes a per-dentry kmalloc()+kfree(), this overhead exists only when processing the minority of messages that spill into vmalloc(). My (crude) testing puts this at only about 1 in 8,000 readdir messages. Still, if the overhead proves unreasonable in the future, it is easy enough to mitigate: a future change could allocate a bounce buffer in parse_reply_info_readdir() and use that as `tname` instead.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ceph: properly decrypt filenames in vmalloc() buffers The fscrypt subsystem uses the scatterlist crypto     API, inheriting its requirement that any buffers are in the linear mapping region. However, the messenger     client uses kvmalloc() to create buffers for messages, which will occasionally place those buffers in the     vmalloc() region when physical memory fragmentation doesn't permit a large enough kmalloc(). The various     callers of ceph_fname_to_usr() directly pass (slices of) raw messages from the MDS without considering     that the messages may be in vmalloc() buffers, resulting in oopses especially on non-x86 platforms (see     'Closes:' for more details and a reproducer). Make ceph_fname_to_usr() explicitly tolerant of     vmalloc()-allocated fname->ctext, fname->name, and/or oname->name buffers, using `tname` (which, when non-     null, must be a linear address; when null, is briefly allocated as necessary) as a bounce buffer to avoid     passing any inappropriate addresses to fscrypt_fname_disk_to_usr(). Additionally change     parse_reply_info_readdir() -- the only function to supply its own `tname` -- to follow the new tname must     never come from vmalloc() rule by passing NULL when the message is not in the linear region. Though this     causes a per-dentry kmalloc()+kfree(), this overhead exists only when processing the minority of messages     that spill into vmalloc(). My (crude) testing puts this at only about 1 in 8,000 readdir messages. Still,     if the overhead proves unreasonable in the future, it is easy enough to mitigate: a future change could     allocate a bounce buffer in parse_reply_info_readdir() and use that as `tname` instead. (CVE-2026-90042)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365283	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3187)	Nessus	Amazon Linux Local Security Checks	Local	medium
365209	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3193)	Nessus	Amazon Linux Local Security Checks	Local	medium
364137	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500374)	Nessus	Oracle Linux Local Security Checks	Local	high
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
346616	Linux Distros Unpatched Vulnerability : CVE-2026-90042	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-90042

critical

Tenable Plugins

medium

medium

high

high

high

critical