CVE-2026-68160

A flaw was found in the Linux kernel's Ceph component. A remote attacker could exploit this by sending a specially crafted message with a manipulated snaptracelen value. This pre-authentication vulnerability allows for an out-of-bounds read, potentially leading to information disclosure or a deni...

CVE-2026-68159

In the Linux kernel, the following vulnerability has been resolved: libceph: bound pgtemp,upmap,upmapitems length to CEPHPGMAXSIZE decodepgtemp decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPHPGMAXSIZE. The helper back...

EUVD-2026-55546

In the Linux kernel, the following vulnerability has been resolved: ceph: fix pre-auth out-of-bounds read on snaptrace in cephhandlecaps cephhandlecaps reads snaptracelen from the wire-format cephmdscaps header and uses it unconditionally to build a fake end pointer snaptrace + snaptracelen that ...

CVE-2026-68160

The CVE-2026-68160 vulnerability affects Ceph in the Linux kernel where ceph_handle_caps() reads snap_trace_len from the wire-format and uses it to compute snaptrace + snaptrace_len before validation. If msg->hdr.version is 1 (no decoder validation), an attacker-controlled snap_trace_len can d...

CVE-2026-68159 libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE

In the Linux kernel, the following vulnerability has been resolved: libceph: bound pgtemp,upmap,upmapitems length to CEPHPGMAXSIZE decodepgtemp decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPHPGMAXSIZE. The helper back...

CVE-2026-68159

The CVE-Covered issue affects the Linux kernel’s libceph decoding of pg_temp/pg_upmap entries. __decode_pg_temp() decodes a user-controlled length but previously did not bound it to CEPH_PG_MAX_SIZE, allowing potential stack-out-of-bounds writes when an OSDMap contains a long pg_temp/pg_upmap ent...

CVE-2026-68156

The CVE concerns the Linux kernel’s libceph integration. The issue arises in ceph_x_update_authorizer(): when a newer service ticket triggers a rebuild of the authorizer, the code may allocate a new buffer but fail to refresh the cached pointers in auth->authorizer_buf and auth->authorizer_...

EUVD-2026-55542

In the Linux kernel, the following vulnerability has been resolved: libceph: refresh auth-authorizerbuf,len after authorizer update cephxcreateauthorizer caches au-buf-vec.iovbase and au-buf-vec.iovlen in struct cephauthhandshake. These cached values are then used by the messenger connect code wh...

CVE-2026-68155

The CVE describes a fix in libceph within the Linux kernel: monmaps advertising zero monitors are invalid and could crash clients, so a patch in ceph_monmap_decode() now rejects mon_maps where num_mon == 0 (in addition to previous checks for num_mon > CEPH_MAX_MON). This ensures that a monmap ...

EUVD-2026-55541

In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPHMSGMONMAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the existing monitors in the cluster. Currently...

EUVD-2026-55539

In the Linux kernel, the following vulnerability has been resolved: libceph: remove debugfs files before client teardown cephdestroyclient tears down the monitor client before removing the per-client debugfs files. A concurrent read of the monmap debugfs file can enter monmapshow after cephmoncst...

CVE-2026-68153

CVE-2026-68153 involves the Linux kernel’s libceph component where a race during client teardown can cause a use-after-free of monmap data when a concurrent read hits monmap_show() after monc has been freed. The fix, as documented, is to remove per-client debugfs files before stopping the OSD/mon...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ceph: fixed NULL pointer dereference in cephmdsauthmatch The CephFS kernel client has a regression starting from 6.18-rc1. We have a issue with cephmdsauthmatch if fsname is NULL: c const char fsname =...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ceph: Fix for oops due to invalid pointer for kfree in parselongname This fix addresses a kernel oops that occurs when reading ceph snapshot directories .snap, for example, by simply running ls /mnt/myceph/.snap. The variable str...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: libceph: Defined and enforced the CEPHMAXKEYLEN. When decoding the key, verify that the key material fits into a fixed-size buffer in processauthdone, and that its length is reasonable. The new CEPHMAXKEYLEN check replaces the...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: libceph: Replace BUGON with a bounds check for map-maxosd. OSD indexes come from untrusted network packets. Boundaries checks are added to validate these against map-maxosd. idryomov: removed BUGON in cephgetprimaryaffinity, mino...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: libceph: Make freechooseargmap more resilient to partial allocations. freechooseargmap may dereference a NULL pointer if its caller fails after a partial allocation. For example, in decodechooseargs, if the allocation of...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: Ceph: Fixed a crash in processv2sparseread for encrypted directories. A crash in processv2sparseread for fscrypt-encrypted directories has been reported. This issue occurs in the Ceph msgr2 protocol in secure mode. It can be...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: libceph: The monhandleauthdone function should return the error message. Currently, any error from cephauthhandlereplydone is propagated via finishauth, but it is not returned from monhandleauthdone. This results in higher-level...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: libceph: The calctarget function should set t-paused, rather than simply clearing it. Currently, calctarget clears t-paused if the request should no longer be paused. However, it never sets t-paused, even though it can determine...