CVE-2026-68155: libceph: Reject monmaps advertising zero monitors
In the Linux kernel, the following vulnerability has been resolved:
libceph: Reject monmaps advertising zero monitors
A message of type CEPHMSGMONMAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the existing monitors in the cluster. Currently, a monmap indicating that there are zero monitors in the cluster is treated as valid. However, it is impossible to have zero monitors in the cluster and still receive a valid monmap from a monitor. Therefore, such a monmap must be corrupted and should be treated as invalid. Furthermore, a monmap with a monitor count of zero can subsequently crash the client when attempting to open a session with a monitor in opensession(). This happens because the "BUGON(monc->monmap->nummon < 1)" assertion in picknewmon() is triggered.
This patch extends a check in cephmonmapdecode() to also reject arriving monmaps with nummon == 0 rather than only with nummon > CEPHMAXMON.
[ idryomov: drop "log output for unusual values of nummon" part ]
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68155?
CVE-2026-68155 has a risk score of 23.
How does CVE-2026-68155 affect the Linux kernel?
CVE-2026-68155 affects the Linux kernel by allowing monmaps with zero monitors to be improperly processed.
What mitigations are recommended for CVE-2026-68155?
It is recommended to update to the latest version of the Linux kernel that addresses CVE-2026-68155.
When was CVE-2026-68155 published?
CVE-2026-68155 was published on August 10, 2026.
Who is affected by CVE-2026-68155?
Users and administrators of systems using the affected versions of the Linux kernel are at risk for CVE-2026-68155.