PT-2026-69554

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the libceph component where the crush decode function fails to reject zero bucket types. Since CRUSH bucket type 0 is reserved for devices, a malformed CRUSH map can...

CVE-2026-68153: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: libceph: remove debugfs files before client teardown cephdestroyclient tears down the monitor client before removing the per-client debugfs files. A concurrent read of the monmap debugfs file can enter monmapshow after cephmoncst...

CVE-2026-68154: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crushdecode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crushdecode accepts a bucket with type 0, a malformed...

CVE-2026-68158: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix multiplication overflow in decodenewupstateweight If a message of type CEPHMSGOSDMAP contains a maliciously corrupted osdmap, out-of-bounds memory accesses may occur in decodenewupstateweight. This happens because th...

PT-2026-69557

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in libceph where localized read selection can process a parent bucket that has a name in the CRUSH map but lacks a corresponding entry in type names. This leads to the ge...

PT-2026-69555

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in libceph where the system fails to reject monmaps that advertise zero monitors. A monmap, sent from a monitor to the client via a CEPH MSG MON MAP message, contains...

CVE-2026-68159: Stack-based Buffer Overflow

In the Linux kernel, the following vulnerability has been resolved: libceph: bound pgtemp,upmap,upmapitems length to CEPHPGMAXSIZE decodepgtemp decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPHPGMAXSIZE. The helper back...

CVE-2026-68156: Use After Free

In the Linux kernel, the following vulnerability has been resolved: libceph: refresh auth-authorizerbuf,len after authorizer update cephxcreateauthorizer caches au-buf-vec.iovbase and au-buf-vec.iovlen in struct cephauthhandshake. These cached values are then used by the messenger connect code wh...

CVE-2026-68155: Improper Input Validation

In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPHMSGMONMAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the existing monitors in the cluster. Currently...

CVE-2026-68159: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: libceph: bound pgtemp,upmap,upmapitems length to CEPHPGMAXSIZE decodepgtemp decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPHPGMAXSIZE. The helper back...

Linux Distros Unpatched Vulnerability : CVE-2026-68158

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libceph: Fix multiplication overflow in decodenewupstateweight If a message of type CEPHMSGOSDMAP contains a maliciously corrupted osdmap, out-of-bounds memory...

Linux Distros Unpatched Vulnerability : CVE-2026-68153

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libceph: remove debugfs files before client teardown cephdestroyclient tears down the monitor client before removing the per-client debugfs files. A concurrent...

Linux Distros Unpatched Vulnerability : CVE-2026-68159

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libceph: bound pgtemp,upmap,upmapitems length to CEPHPGMAXSIZE decodepgtemp decodes an user- controlled length but only rejects values large enough to overflow...

Linux Distros Unpatched Vulnerability : CVE-2026-68155

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libceph: Reject monmaps advertising zero monitors A message of type CEPHMSGMONMAP contains a monmap that is sent from a monitor to the client. This monmap...

CVE-2026-68157: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: libceph: guard missing CRUSH type name lookup Localized read selection can walk a parent bucket whose name exists in the CRUSH map while its type has no matching entry in typenames. getimmediateparent then dereferences a NULL...

PT-2026-69556

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in libceph where ceph x create authorizer caches the iov base and iov len of the authorizer buffer within the ceph auth handshake structure. When ceph x update authorizer...

CVE-2026-68157: NULL Pointer Dereference

In the Linux kernel, the following vulnerability has been resolved: libceph: guard missing CRUSH type name lookup Localized read selection can walk a parent bucket whose name exists in the CRUSH map while its type has no matching entry in typenames. getimmediateparent then dereferences a NULL...

RHEL 10 : kernel (RHSA-2026:52764)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:52764 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: libceph: make decodepool mor...

PT-2026-69558

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the libceph component where a multiplication overflow can occur within the decode new up state weight function. When processing a CEPH MSG OSD MAP message containing a...

PT-2026-69553

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in libceph where the ceph destroy client function tears down the monitor client before removing per-client debugfs files. This allows a concurrent read of t...