CVE-2026-68161 sctp: close UDP tunnel sockets during netns teardown

In the Linux kernel, the following vulnerability has been resolved: sctp: close UDP tunnel sockets during netns teardown procsctpdoudpport starts per-net SCTP UDP tunneling sockets when net.sctp.udpport is set, and stops/restarts them when the sysctl value changes. The netns exit path does not st...

EUVD-2026-55546

In the Linux kernel, the following vulnerability has been resolved: ceph: fix pre-auth out-of-bounds read on snaptrace in cephhandlecaps cephhandlecaps reads snaptracelen from the wire-format cephmdscaps header and uses it unconditionally to build a fake end pointer snaptrace + snaptracelen that ...

CVE-2026-68160

In the Linux kernel, the following vulnerability has been resolved: ceph: fix pre-auth out-of-bounds read on snaptrace in cephhandlecaps cephhandlecaps reads snaptracelen from the wire-format cephmdscaps header and uses it unconditionally to build a fake end pointer snaptrace + snaptracelen that ...

EUVD-2026-55545

In the Linux kernel, the following vulnerability has been resolved: libceph: bound pgtemp,upmap,upmapitems length to CEPHPGMAXSIZE decodepgtemp decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPHPGMAXSIZE. The helper back...

CVE-2026-68159 libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE

In the Linux kernel, the following vulnerability has been resolved: libceph: bound pgtemp,upmap,upmapitems length to CEPHPGMAXSIZE decodepgtemp decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPHPGMAXSIZE. The helper back...

CVE-2026-68159 libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE

In the Linux kernel, the following vulnerability has been resolved: libceph: bound pgtemp,upmap,upmapitems length to CEPHPGMAXSIZE decodepgtemp decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPHPGMAXSIZE. The helper back...

CVE-2026-68159

In the Linux kernel, the following vulnerability has been resolved: libceph: bound pgtemp,upmap,upmapitems length to CEPHPGMAXSIZE decodepgtemp decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPHPGMAXSIZE. The helper back...

CVE-2026-68159

CVE-2026-68159 (Linux kernel libceph bound check) : The issue occurs when decoding pg_temp/pg_upmap entries in libceph within the kernel. __decode_pg_temp() may accept a user-controlled length that overflows the allocation, and the same applies to __decode_pg_upmap_items(); decoded data is later ...

CVE-2026-68158

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix multiplication overflow in decodenewupstateweight If a message of type CEPHMSGOSDMAP contains a maliciously corrupted osdmap, out-of-bounds memory accesses may occur in decodenewupstateweight. This happens because th...

CVE-2026-68157 libceph: guard missing CRUSH type name lookup

In the Linux kernel, the following vulnerability has been resolved: libceph: guard missing CRUSH type name lookup Localized read selection can walk a parent bucket whose name exists in the CRUSH map while its type has no matching entry in typenames. getimmediateparent then dereferences a NULL...

CVE-2026-68157

In the Linux kernel, the following vulnerability has been resolved: libceph: guard missing CRUSH type name lookup Localized read selection can walk a parent bucket whose name exists in the CRUSH map while its type has no matching entry in typenames. getimmediateparent then dereferences a NULL...

EUVD-2026-55543

In the Linux kernel, the following vulnerability has been resolved: libceph: guard missing CRUSH type name lookup Localized read selection can walk a parent bucket whose name exists in the CRUSH map while its type has no matching entry in typenames. getimmediateparent then dereferences a NULL...

CVE-2026-68156 libceph: refresh auth->authorizer_buf{,_len} after authorizer update

In the Linux kernel, the following vulnerability has been resolved: libceph: refresh auth-authorizerbuf,len after authorizer update cephxcreateauthorizer caches au-buf-vec.iovbase and au-buf-vec.iovlen in struct cephauthhandshake. These cached values are then used by the messenger connect code wh...

CVE-2026-68156

In the Linux kernel, the following vulnerability has been resolved: libceph: refresh auth-authorizerbuf,len after authorizer update cephxcreateauthorizer caches au-buf-vec.iovbase and au-buf-vec.iovlen in struct cephauthhandshake. These cached values are then used by the messenger connect code wh...

CVE-2026-68156

The CVE-2026-68156 issue affects the Linux kernel libceph path: during an authorizer update, ceph_x_update_authorizer() may rebuild the authorizer and, if the new authorizer won’t fit in the existing buffer, it frees the old buffer while auth->authorizer_buf still points to the freed memory. A...

EUVD-2026-55542

In the Linux kernel, the following vulnerability has been resolved: libceph: refresh auth-authorizerbuf,len after authorizer update cephxcreateauthorizer caches au-buf-vec.iovbase and au-buf-vec.iovlen in struct cephauthhandshake. These cached values are then used by the messenger connect code wh...

EUVD-2026-55541

In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPHMSGMONMAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the existing monitors in the cluster. Currently...

CVE-2026-68155 libceph: Reject monmaps advertising zero monitors

In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPHMSGMONMAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the existing monitors in the cluster. Currently...

CVE-2026-68155

In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPHMSGMONMAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the existing monitors in the cluster. Currently...

CVE-2026-68154

In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crushdecode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crushdecode accepts a bucket with type 0, a malformed...