{"api_version":"1","generated_at":"2026-09-15T14:17:07+00:00","cve":"CVE-2026-68154","urls":{"html":"https://cve.report/CVE-2026-68154","api":"https://cve.report/api/cve/CVE-2026-68154.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-68154","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-68154"},"summary":{"title":"libceph: reject zero bucket types in crush_decode","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: reject zero bucket types in crush_decode\n\nCRUSH bucket type 0 is reserved for devices.  The mapper relies on\nthat invariant and uses type 0 to identify leaf devices.\n\nIf crush_decode() accepts a bucket with type 0, a malformed CRUSH map\ncan make the mapper treat a negative bucket ID as a device and pass it\nto is_out(), which then indexes the OSD weight array with a negative\nvalue.\n\nReject zero bucket types while decoding the CRUSH map so the invalid\nstate never reaches the mapper.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-10 13:20:01","updated_at":"2026-08-19 17:20:32"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/80fc40e11cda1b5d990a3f69c6efa344fb5cd987","name":"https://git.kernel.org/stable/c/80fc40e11cda1b5d990a3f69c6efa344fb5cd987","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/70998f91030ee083ecb336a1dff0701c20a38081","name":"https://git.kernel.org/stable/c/70998f91030ee083ecb336a1dff0701c20a38081","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/826cd1de5802fd392922785f9b64d76e65d2a100","name":"https://git.kernel.org/stable/c/826cd1de5802fd392922785f9b64d76e65d2a100","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/3b2f1937f5fce8b7dd5432e7693e3cc8b5eece56","name":"https://git.kernel.org/stable/c/3b2f1937f5fce8b7dd5432e7693e3cc8b5eece56","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/146461f09565afe3665e65b0423d3d6b0fe806c5","name":"https://git.kernel.org/stable/c/146461f09565afe3665e65b0423d3d6b0fe806c5","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/952ca5dc99913d169263f59fd689f586729a13c1","name":"https://git.kernel.org/stable/c/952ca5dc99913d169263f59fd689f586729a13c1","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b8a9fb6bf806f9c4891e71ae1beab0c07c23a877","name":"https://git.kernel.org/stable/c/b8a9fb6bf806f9c4891e71ae1beab0c07c23a877","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/05f90284223381005d6bcddab3fda4a97f9c3401","name":"https://git.kernel.org/stable/c/05f90284223381005d6bcddab3fda4a97f9c3401","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68154","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68154","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f24e9980eb860d8600cbe5ef3d2fd9295320d229 952ca5dc99913d169263f59fd689f586729a13c1 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f24e9980eb860d8600cbe5ef3d2fd9295320d229 146461f09565afe3665e65b0423d3d6b0fe806c5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f24e9980eb860d8600cbe5ef3d2fd9295320d229 80fc40e11cda1b5d990a3f69c6efa344fb5cd987 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f24e9980eb860d8600cbe5ef3d2fd9295320d229 b8a9fb6bf806f9c4891e71ae1beab0c07c23a877 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f24e9980eb860d8600cbe5ef3d2fd9295320d229 826cd1de5802fd392922785f9b64d76e65d2a100 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f24e9980eb860d8600cbe5ef3d2fd9295320d229 3b2f1937f5fce8b7dd5432e7693e3cc8b5eece56 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f24e9980eb860d8600cbe5ef3d2fd9295320d229 70998f91030ee083ecb336a1dff0701c20a38081 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f24e9980eb860d8600cbe5ef3d2fd9295320d229 05f90284223381005d6bcddab3fda4a97f9c3401 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.34","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 2.6.34 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.265 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.216 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.183 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.148 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.101 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.42 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.6 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"68154","cve":"CVE-2026-68154","epss":"0.006260000","percentile":"0.473100000","score_date":"2026-08-19","updated_at":"2026-08-20 00:13:09"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ceph/osdmap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"952ca5dc99913d169263f59fd689f586729a13c1","status":"affected","version":"f24e9980eb860d8600cbe5ef3d2fd9295320d229","versionType":"git"},{"lessThan":"146461f09565afe3665e65b0423d3d6b0fe806c5","status":"affected","version":"f24e9980eb860d8600cbe5ef3d2fd9295320d229","versionType":"git"},{"lessThan":"80fc40e11cda1b5d990a3f69c6efa344fb5cd987","status":"affected","version":"f24e9980eb860d8600cbe5ef3d2fd9295320d229","versionType":"git"},{"lessThan":"b8a9fb6bf806f9c4891e71ae1beab0c07c23a877","status":"affected","version":"f24e9980eb860d8600cbe5ef3d2fd9295320d229","versionType":"git"},{"lessThan":"826cd1de5802fd392922785f9b64d76e65d2a100","status":"affected","version":"f24e9980eb860d8600cbe5ef3d2fd9295320d229","versionType":"git"},{"lessThan":"3b2f1937f5fce8b7dd5432e7693e3cc8b5eece56","status":"affected","version":"f24e9980eb860d8600cbe5ef3d2fd9295320d229","versionType":"git"},{"lessThan":"70998f91030ee083ecb336a1dff0701c20a38081","status":"affected","version":"f24e9980eb860d8600cbe5ef3d2fd9295320d229","versionType":"git"},{"lessThan":"05f90284223381005d6bcddab3fda4a97f9c3401","status":"affected","version":"f24e9980eb860d8600cbe5ef3d2fd9295320d229","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ceph/osdmap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.34"},{"lessThan":"2.6.34","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.265","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.216","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.183","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.148","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.101","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.265","versionStartIncluding":"2.6.34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.216","versionStartIncluding":"2.6.34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.183","versionStartIncluding":"2.6.34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.148","versionStartIncluding":"2.6.34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.101","versionStartIncluding":"2.6.34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.42","versionStartIncluding":"2.6.34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.6","versionStartIncluding":"2.6.34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"2.6.34","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: reject zero bucket types in crush_decode\n\nCRUSH bucket type 0 is reserved for devices.  The mapper relies on\nthat invariant and uses type 0 to identify leaf devices.\n\nIf crush_decode() accepts a bucket with type 0, a malformed CRUSH map\ncan make the mapper treat a negative bucket ID as a device and pass it\nto is_out(), which then indexes the OSD weight array with a negative\nvalue.\n\nReject zero bucket types while decoding the CRUSH map so the invalid\nstate never reaches the mapper."}],"metrics":[{"cvssV3_1":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:N - The flaw is reached when the in-kernel Ceph client decodes a crafted CRUSH map inside CEPH_MSG_OSD_MAP received over TCP from a Ceph monitor or OSD, which is a standard network-delivered cluster control message on connected storage clients.\nAC:L - An attacker can reliably craft a CRUSH map with a bucket whose type field is zero and controlled hierarchy/items so crush_do_rule() later calls is_out() with a negative index, without races, victim-specific memory layout, or rare kernel build options.\nPR:N - No local privileges on the victim host are required; a remote attacker who controls, compromises, or MITMs the authenticated Ceph monitor/OSD peer can deliver the malicious OSD map over the established client cluster connection.\nUI:N - No additional victim action is needed at exploit time because poisoned OSD maps are processed automatically and CRUSH placement is recalculated during routine map updates, request rescanning, and normal Ceph client I/O.\nS:U - The vulnerability corrupts or reads kernel memory on the host running the Ceph client, affecting that kernel security domain rather than crossing a VM, container sandbox, or IOMMU boundary.\nC:H - When a type-0 bucket makes the mapper treat a negative bucket ID as a device, is_out() indexes osd_weight[] with a negative value, causing an out-of-bounds read of adjacent kernel memory beyond the OSD weight array.\nI:H - This out-of-bounds kernel heap access during CRUSH placement is memory corruption in a privileged parser/mapper path that can be leveraged for further kernel memory control and arbitrary code execution, not only information disclosure.\nA:H - The invalid negative indexing during CRUSH mapping can dereference unmapped or non-resident memory and trigger a kernel oops or panic, causing complete loss of availability on affected Ceph client hosts."}]}],"providerMetadata":{"dateUpdated":"2026-08-19T16:30:20.481Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/952ca5dc99913d169263f59fd689f586729a13c1"},{"url":"https://git.kernel.org/stable/c/146461f09565afe3665e65b0423d3d6b0fe806c5"},{"url":"https://git.kernel.org/stable/c/80fc40e11cda1b5d990a3f69c6efa344fb5cd987"},{"url":"https://git.kernel.org/stable/c/b8a9fb6bf806f9c4891e71ae1beab0c07c23a877"},{"url":"https://git.kernel.org/stable/c/826cd1de5802fd392922785f9b64d76e65d2a100"},{"url":"https://git.kernel.org/stable/c/3b2f1937f5fce8b7dd5432e7693e3cc8b5eece56"},{"url":"https://git.kernel.org/stable/c/70998f91030ee083ecb336a1dff0701c20a38081"},{"url":"https://git.kernel.org/stable/c/05f90284223381005d6bcddab3fda4a97f9c3401"}],"title":"libceph: reject zero bucket types in crush_decode","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-68154","datePublished":"2026-08-10T11:59:20.250Z","dateReserved":"2026-07-30T09:28:09.371Z","dateUpdated":"2026-08-19T16:30:20.481Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-10 13:20:01","lastModifiedDate":"2026-08-19 17:20:32","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"68154","Ordinal":"1","Title":"libceph: reject zero bucket types in crush_decode","CVE":"CVE-2026-68154","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"68154","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: reject zero bucket types in crush_decode\n\nCRUSH bucket type 0 is reserved for devices.  The mapper relies on\nthat invariant and uses type 0 to identify leaf devices.\n\nIf crush_decode() accepts a bucket with type 0, a malformed CRUSH map\ncan make the mapper treat a negative bucket ID as a device and pass it\nto is_out(), which then indexes the OSD weight array with a negative\nvalue.\n\nReject zero bucket types while decoding the CRUSH map so the invalid\nstate never reaches the mapper.","Type":"Description","Title":"libceph: reject zero bucket types in crush_decode"}]}}}