CVE-2026-68154 libceph: reject zero bucket types in crush_decode

In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crushdecode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crushdecode accepts a bucket with type 0, a malformed...

CVE-2026-68154

The CVE-2026-68154 vulnerability affects the Linux kernel’s libceph component, where CRUSH map decoding accepts bucket type 0 (reserved for devices) can let a malformed map cause a negative bucket ID to index the OSD weight array, leading to denial of service. The issue is fixed by rejecting zero...

CVE-2026-68154 libceph: reject zero bucket types in crush_decode

In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crushdecode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crushdecode accepts a bucket with type 0, a malformed...

EUVD-2026-55540

In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crushdecode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crushdecode accepts a bucket with type 0, a malformed...

EUVD-2026-55539

In the Linux kernel, the following vulnerability has been resolved: libceph: remove debugfs files before client teardown cephdestroyclient tears down the monitor client before removing the per-client debugfs files. A concurrent read of the monmap debugfs file can enter monmapshow after cephmoncst...

CVE-2026-68153 libceph: remove debugfs files before client teardown

In the Linux kernel, the following vulnerability has been resolved: libceph: remove debugfs files before client teardown cephdestroyclient tears down the monitor client before removing the per-client debugfs files. A concurrent read of the monmap debugfs file can enter monmapshow after cephmoncst...

CVE-2026-68153 libceph: remove debugfs files before client teardown

In the Linux kernel, the following vulnerability has been resolved: libceph: remove debugfs files before client teardown cephdestroyclient tears down the monitor client before removing the per-client debugfs files. A concurrent read of the monmap debugfs file can enter monmapshow after cephmoncst...

kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental()

In the Linux kernel, the following vulnerability has been resolved: libceph: replace overzealous BUGON in osdmapapplyincremental If the osdmap is maliciously corrupted such that the incremental osdmap epoch is different from what is expected, there is no need to BUG. Instead, just declare the...

kernel: libceph: make decode_pool() more resilient against corrupted osdmaps

In the Linux kernel, the following vulnerability has been resolved: libceph: make decodepool more resilient against corrupted osdmaps If the osdmap is maliciously corrupted such that the encoded length of cephpgpool envelope is less than what is expected for a particular encoding version,...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: libceph: Replace BUGON with a bounds check for map-maxosd. OSD indexes come from untrusted network packets. Boundaries checks are added to validate these against map-maxosd. idryomov: removed BUGON in cephgetprimaryaffinity, mino...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: libceph: Defined and enforced the CEPHMAXKEYLEN. When decoding the key, verify that the key material fits into a fixed-size buffer in processauthdone, and that its length is reasonable. The new CEPHMAXKEYLEN check replaces the...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: libceph: fixed a potential use-after-free in havemonandosdmap The wait loop in cephopensession can race with the client receiving a new monmap or osdmap shortly after the initial map is received. Both cephmonchandlemap and...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: libceph: Prevent potential out-of-bounds reads in handleauthdone. Perform an explicit bounds check on payloadlen to avoid possible out-of-bounds accesses during the callout operation. idryomov: changelog...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: libceph: Potential out-of-bounds writes have been prevented in the handleauthsessionkey function. The len field originates from untrusted network packets. Boundary checks have been added to prevent potential out-of-bounds writes...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: libceph: The state of sparse-read was reset in osdfault. When a fault occurs, the connection is abandoned, re-established, and any pending operations are retried. The OSD client tracks the progress of a sparse-read reply using a...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: libceph: makes decodepool more resilient against corrupted osdmaps. If the osdmap is maliciously corrupted in such a way that the encoded length of the cephpgpool envelope is less than what is expected for a particular encoding...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: libceph: Replace the “overzealous” bug in osdmapapplyincremental. If the osdmap is maliciously corrupted, causing the incremental osdmap epoch to differ from what is expected, there is no need to report a bug. Instead, simply...

Linux Distros Unpatched Vulnerability : CVE-2026-68157

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libceph: guard missing CRUSH type name lookup Localized read selection can walk a parent bucket whose name exists in the CRUSH map while its type has no matchin...

Linux Distros Unpatched Vulnerability : CVE-2026-68158

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libceph: Fix multiplication overflow in decodenewupstateweight If a message of type CEPHMSGOSDMAP contains a maliciously corrupted osdmap, out-of-bounds memory...

Linux Distros Unpatched Vulnerability : CVE-2026-68155

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libceph: Reject monmaps advertising zero monitors A message of type CEPHMSGMONMAP contains a monmap that is sent from a monitor to the client. This monmap...