CVE-2026-68154

In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crush_decode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crush_decode() accepts a bucket with type 0, a malformed CRUSH map can make the mapper treat a negative bucket ID as a device and pass it to is_out(), which then indexes the OSD weight array with a negative value. Reject zero bucket types while decoding the CRUSH map so the invalid state never reaches the mapper.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/05f90284223381005d6bcddab3fda4a97f9c3401
https://git.kernel.org/stable/c/146461f09565afe3665e65b0423d3d6b0fe806c5
https://git.kernel.org/stable/c/3b2f1937f5fce8b7dd5432e7693e3cc8b5eece56
https://git.kernel.org/stable/c/70998f91030ee083ecb336a1dff0701c20a38081
https://git.kernel.org/stable/c/80fc40e11cda1b5d990a3f69c6efa344fb5cd987
https://git.kernel.org/stable/c/826cd1de5802fd392922785f9b64d76e65d2a100
https://git.kernel.org/stable/c/952ca5dc99913d169263f59fd689f586729a13c1
https://git.kernel.org/stable/c/b8a9fb6bf806f9c4891e71ae1beab0c07c23a877

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-10 13:20

Updated : 2026-08-19 17:20

NVD link : CVE-2026-68154

Mitre link : CVE-2026-68154

CVE.ORG link : CVE-2026-68154

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-68154", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229", "lessThan": "952ca5dc99913d169263f59fd689f586729a13c1", "versionType": "git"}, {"status": "affected", "version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229", "lessThan": "146461f09565afe3665e65b0423d3d6b0fe806c5", "versionType": "git"}, {"status": "affected", "version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229", "lessThan": "80fc40e11cda1b5d990a3f69c6efa344fb5cd987", "versionType": "git"}, {"status": "affected", "version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229", "lessThan": "b8a9fb6bf806f9c4891e71ae1beab0c07c23a877", "versionType": "git"}, {"status": "affected", "version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229", "lessThan": "826cd1de5802fd392922785f9b64d76e65d2a100", "versionType": "git"}, {"status": "affected", "version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229", "lessThan": "3b2f1937f5fce8b7dd5432e7693e3cc8b5eece56", "versionType": "git"}, {"status": "affected", "version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229", "lessThan": "70998f91030ee083ecb336a1dff0701c20a38081", "versionType": "git"}, {"status": "affected", "version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229", "lessThan": "05f90284223381005d6bcddab3fda4a97f9c3401", "versionType": "git"}], "programFiles": ["net/ceph/osdmap.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.34"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.34", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.265", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.216", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.148", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.101", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.42", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.6", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/ceph/osdmap.c"], "defaultStatus": "affected"}]}], "published": "2026-08-10T13:20:01.533", "references": [{"url": "https://git.kernel.org/stable/c/05f90284223381005d6bcddab3fda4a97f9c3401", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/146461f09565afe3665e65b0423d3d6b0fe806c5", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/3b2f1937f5fce8b7dd5432e7693e3cc8b5eece56", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/70998f91030ee083ecb336a1dff0701c20a38081", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/80fc40e11cda1b5d990a3f69c6efa344fb5cd987", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/826cd1de5802fd392922785f9b64d76e65d2a100", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/952ca5dc99913d169263f59fd689f586729a13c1", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b8a9fb6bf806f9c4891e71ae1beab0c07c23a877", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: reject zero bucket types in crush_decode\n\nCRUSH bucket type 0 is reserved for devices. The mapper relies on\nthat invariant and uses type 0 to identify leaf devices.\n\nIf crush_decode() accepts a bucket with type 0, a malformed CRUSH map\ncan make the mapper treat a negative bucket ID as a device and pass it\nto is_out(), which then indexes the OSD weight array with a negative\nvalue.\n\nReject zero bucket types while decoding the CRUSH map so the invalid\nstate never reaches the mapper."}], "lastModified": "2026-08-19T17:20:32.537", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}