CVE-2026-68154: libceph: reject zero bucket types in crush_decode
In the Linux kernel, the following vulnerability has been resolved:
libceph: reject zero bucket types in crushdecode
CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices.
If crushdecode() accepts a bucket with type 0, a malformed CRUSH map can make the mapper treat a negative bucket ID as a device and pass it to isout(), which then indexes the OSD weight array with a negative value.
Reject zero bucket types while decoding the CRUSH map so the invalid state never reaches the mapper.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68154?
CVE-2026-68154 has a risk score of 40, indicating it is a serious vulnerability in the libceph functionality.
How do I fix CVE-2026-68154?
To address CVE-2026-68154, apply the latest security patches provided in the kernel updates from your distribution.
What systems are affected by CVE-2026-68154?
CVE-2026-68154 affects systems that utilize the libceph functionality in the Linux kernel.
What are the potential impacts of CVE-2026-68154?
The potential impacts of CVE-2026-68154 include the exploitation of malformed bucket types which could lead to system instability or unauthorized access.
When was CVE-2026-68154 published?
CVE-2026-68154 was published on August 10, 2026.