CVE-2023-44466: Linux kernel Ceph messenger_v2 integer signedness buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityRemote code execution with high EPSS and public exploit material, though exploitation requires low privileges and no KEV listing.

What it is

The Linux kernel Ceph messenger_v2 code before 6.4.5 mishandles an untrusted length from a TCP packet in ceph_decode_32, causing an integer signedness error and buffer overflow. A remote peer can trigger it through HELLO or AUTH frames, and the flaw can lead to remote code execution.

Impact

An attacker who can reach the Ceph messenger path gains memory corruption that can be turned into remote code execution in kernel context, giving full control of confidentiality, integrity and availability.

Attack surface

Reached over the network via crafted Ceph HELLO or AUTH frames on a TCP connection; the CVSS vector requires low privileges (PR:L) and no user interaction (UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is 0.45301 (98.7th percentile) and a reference is tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade the Linux kernel to 6.4.5 or later, or apply the upstream commit a282a2f10539dce2aa619e71e1817570d557fc97.
• Restrict network access to Ceph messenger ports to trusted peers only.
• Apply vendor advisories such as NetApp ntap-20231116-0003 for affected products.
• Monitor for and block untrusted Ceph clients that cannot be patched immediately.

Detection

• Inspect kernel logs for Ceph messenger_v2 errors or crashes around HELLO/AUTH frame handling.
• Use network monitoring to flag malformed or oversized Ceph HELLO/AUTH frames on messenger ports.
• Track kernel versions in the fleet and alert on hosts still running kernels before 6.4.5.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.