3696 matches found
CVE-2026-68159
In the Linux kernel, the following vulnerability has been resolved: libceph: bound pgtemp,upmap,upmapitems length to CEPHPGMAXSIZE decodepgtemp decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPHPGMAXSIZE. The helper back...
CVE-2026-68155
In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPHMSGMONMAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the existing monitors in the cluster. Currently...
DEBIAN-CVE-2026-68157
In the Linux kernel, the following vulnerability has been resolved: libceph: guard missing CRUSH type name lookup Localized read selection can walk a parent bucket whose name exists in the CRUSH map while its type has no matching entry in typenames. getimmediateparent then dereferences a NULL...
UBUNTU-CVE-2026-68155
In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPHMSGMONMAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the existing monitors in the cluster. Currently...
CVE-2026-68154
In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crushdecode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crushdecode accepts a bucket with type 0, a malformed...
UBUNTU-CVE-2026-68156
In the Linux kernel, the following vulnerability has been resolved: libceph: refresh auth-authorizerbuf,len after authorizer update cephxcreateauthorizer caches au-buf-vec.iovbase and au-buf-vec.iovlen in struct cephauthhandshake. These cached values are then used by the messenger connect code wh...
CVE-2026-68160
In the Linux kernel, the following vulnerability has been resolved: ceph: fix pre-auth out-of-bounds read on snaptrace in cephhandlecaps cephhandlecaps reads snaptracelen from the wire-format cephmdscaps header and uses it unconditionally to build a fake end pointer snaptrace + snaptracelen that ...
CVE-2026-68159
In the Linux kernel, the following vulnerability has been resolved: libceph: bound pgtemp,upmap,upmapitems length to CEPHPGMAXSIZE decodepgtemp decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPHPGMAXSIZE. The helper back...
UBUNTU-CVE-2026-68160
In the Linux kernel, the following vulnerability has been resolved: ceph: fix pre-auth out-of-bounds read on snaptrace in cephhandlecaps cephhandlecaps reads snaptracelen from the wire-format cephmdscaps header and uses it unconditionally to build a fake end pointer snaptrace + snaptracelen that ...
UBUNTU-CVE-2026-68154
In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crushdecode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crushdecode accepts a bucket with type 0, a malformed...
CVE-2026-68155
In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPHMSGMONMAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the existing monitors in the cluster. Currently...
EUVD-2026-55546
In the Linux kernel, the following vulnerability has been resolved: ceph: fix pre-auth out-of-bounds read on snaptrace in cephhandlecaps cephhandlecaps reads snaptracelen from the wire-format cephmdscaps header and uses it unconditionally to build a fake end pointer snaptrace + snaptracelen that ...
CVE-2026-68160 ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
In the Linux kernel, the following vulnerability has been resolved: ceph: fix pre-auth out-of-bounds read on snaptrace in cephhandlecaps cephhandlecaps reads snaptracelen from the wire-format cephmdscaps header and uses it unconditionally to build a fake end pointer snaptrace + snaptracelen that ...
CVE-2026-68160 ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
In the Linux kernel, the following vulnerability has been resolved: ceph: fix pre-auth out-of-bounds read on snaptrace in cephhandlecaps cephhandlecaps reads snaptracelen from the wire-format cephmdscaps header and uses it unconditionally to build a fake end pointer snaptrace + snaptracelen that ...
CVE-2026-68160 ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
In the Linux kernel, the following vulnerability has been resolved: ceph: fix pre-auth out-of-bounds read on snaptrace in cephhandlecaps cephhandlecaps reads snaptracelen from the wire-format cephmdscaps header and uses it unconditionally to build a fake end pointer snaptrace + snaptracelen that ...
CVE-2026-68160
Summary: CVE-2026-68160 is a pre-auth, out-of-bounds read vulnerability in the Linux kernel’s Ceph code path (ceph_handle_caps) caused by using attacker-controlled snap_trace_len to compute an end pointer without proper bounds checks. The issue can lead to out-of-bounds reads of encoded snap data...
CVE-2026-68159 libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
In the Linux kernel, the following vulnerability has been resolved: libceph: bound pgtemp,upmap,upmapitems length to CEPHPGMAXSIZE decodepgtemp decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPHPGMAXSIZE. The helper back...
CVE-2026-68159
CVE-2026-68159 (Linux kernel libceph bound check) : The issue occurs when decoding pg_temp/pg_upmap entries in libceph within the kernel. __decode_pg_temp() may accept a user-controlled length that overflows the allocation, and the same applies to __decode_pg_upmap_items(); decoded data is later ...
EUVD-2026-55542
In the Linux kernel, the following vulnerability has been resolved: libceph: refresh auth-authorizerbuf,len after authorizer update cephxcreateauthorizer caches au-buf-vec.iovbase and au-buf-vec.iovlen in struct cephauthhandshake. These cached values are then used by the messenger connect code wh...
CVE-2026-68156
The CVE-2026-68156 issue affects the Linux kernel libceph path: during an authorizer update, ceph_x_update_authorizer() may rebuild the authorizer and, if the new authorizer won’t fit in the existing buffer, it frees the old buffer while auth->authorizer_buf still points to the freed memory. A...