CVE-2026-68433: libceph: bound get_version reply decode to front len
In the Linux kernel, the following vulnerability has been resolved:
libceph: bound getversion reply decode to front len
handlegetversionreply() uses msg->frontalloclen as the decode boundary for MONGETVERSIONREPLY. That is the size of the reused reply buffer, not the number of bytes actually received.
A truncated reply can therefore pass cephdecodeneed() and decode the second u64 from stale tail bytes left in the buffer by an earlier message, causing an uninitialized memory read.
Use msg->front.iovlen as the receive-side decode boundary, matching other libceph reply handlers and limiting decoding to the bytes that were actually read from the wire.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68433?
CVE-2026-68433 has a risk rating of 17, indicating a high severity vulnerability.
How do I fix CVE-2026-68433?
To remediate CVE-2026-68433, update to the latest version of the Linux kernel where the vulnerability is patched.
What impact does CVE-2026-68433 have on the Linux kernel?
CVE-2026-68433 could potentially allow an attacker to exploit buffer handling issues in the libceph component of the Linux kernel.
In which component of the Linux kernel is CVE-2026-68433 found?
CVE-2026-68433 is found in the libceph component of the Linux kernel.
What is the nature of the vulnerability in CVE-2026-68433?
The vulnerability in CVE-2026-68433 involves improper handling of message decoding boundaries, which can lead to buffer overflows.