Reproduced on 24.04 (6.8.0-134-generic).
The issue comes from commit ac431d597a9bdfc2ba6b314813f29a6ef2b4a3bf
(CVE-2026-43304 hardening), where CEPH_MAX_KEY_LEN was set to 16 in
net/ceph/crypto.h. That breaks 32-byte (AES-256) keys introduced in Ceph
19.2.6+ / 20.2.4+ for CVE-2025-30156.
When rbd map adds the key, ceph_crypto_key_decode() rejects it with -EINVAL:
[854942.309259] libceph: secret too big 32
Attached lp-2166680-libceph-allow-256-bit-aes-keys.patch bumps
CEPH_MAX_KEY_LEN to 32. The kernel crypto cbc(aes) cipher already
supports 256-bit keys out of the box.
Standalone reproducer using add_key(2) directly without needing a ceph
cluster:
------python------
import ctypes
import struct
libc = ctypes.CDLL("libc.so.6", use_errno=True)
SYS_add_key = 248 # x86_64
def test_key(key_len):
payload = struct.pack('<HIIH', 1, 0, 0, key_len) + b'K' * key_len
ret = libc.syscall(SYS_add_key, b"ceph", f"client.test{key_len}".encode(),
payload, len(payload), -4)
print(f"Key len {key_len} bytes: return={ret}, errno={ctypes.get_errno()}")
test_key(16) # return > 0, errno 0
test_key(32) # return -1, errno 22 -> dmesg: "libceph: secret too big 32"
** CVE added: https://cve.org/CVERecord?id=CVE-2026-43304
** Patch added: "libceph: bump CEPH_MAX_KEY_LEN to 32 for AES-256 CephX keys"
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2166680/+attachment/6000373/+files/lp-2166680-libceph-allow-256-bit-aes-keys.patch
** Tags added: patch
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2166680
Title:
6.8.0 - rbd kernel module does not allow 256 cephx keys
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2166680/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
