DEBIAN-CVE-2026-68156

In the Linux kernel, the following vulnerability has been resolved:  libceph: refresh auth->authorizerbuf{,len} after authorizer update  cephxcreateauthorizer() caches au->buf->vec.iovbase and au->buf->vec.iovlen in struct cephauthhandshake.  These cached values are then used by the messenger connect code when sending the authorizer.  cephxupdateauthorizer() can rebuild the authorizer when a newer service ticket is available.  If the rebuilt authorizer no longer fits in the existing buffer, cephxbuildauthorizer() drops its reference to au->buf and allocates a new one.  If this is the final reference, cephbufferput() frees the old cephbuffer and its vec.iovbase, but auth->authorizerbuf still points at that freed memory.  A subsequent msgr1 reconnect can therefore queue the stale pointer and trigger a KASAN slab-use-after-free in copyfromiter() while tcpsendmsg() copies the authorizer.  Refresh auth->authorizerbuf and auth->authorizerbuf_len after a successful authorizer rebuild so the messenger sends the current buffer.