CVE-2026-68157 (GCVE-0-2026-68157)
Vulnerability from cvelistv5
Published
2026-08-10 11:59
Modified
2026-08-19 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: guard missing CRUSH type name lookup
Localized read selection can walk a parent bucket whose name exists in
the CRUSH map while its type has no matching entry in type_names.
get_immediate_parent() then dereferences a NULL type_cn and passes an
invalid pointer into strcmp(), causing a null-ptr-deref.
Skip such malformed parent buckets unless both the bucket name and type
name metadata are present. This keeps malformed hierarchy data from
crashing locality lookup and safely falls back to "not local".
[ idryomov: add WARN_ON_ONCE ]
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 117d96a04f007ce8fc2e292369056c3bd09f6f63 Version: 117d96a04f007ce8fc2e292369056c3bd09f6f63 Version: 117d96a04f007ce8fc2e292369056c3bd09f6f63 Version: 117d96a04f007ce8fc2e292369056c3bd09f6f63 Version: 117d96a04f007ce8fc2e292369056c3bd09f6f63 Version: 117d96a04f007ce8fc2e292369056c3bd09f6f63 Version: 117d96a04f007ce8fc2e292369056c3bd09f6f63 Version: 117d96a04f007ce8fc2e292369056c3bd09f6f63 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/osdmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cbfcba275326c8c7dae9acd8f4a0d4c316fdafb0",
"status": "affected",
"version": "117d96a04f007ce8fc2e292369056c3bd09f6f63",
"versionType": "git"
},
{
"lessThan": "8ff579ac03d6e9d17d6d9c8443110167c14a382d",
"status": "affected",
"version": "117d96a04f007ce8fc2e292369056c3bd09f6f63",
"versionType": "git"
},
{
"lessThan": "6a4b75d90f0cfbf22c14742ab35a803bc13f36ec",
"status": "affected",
"version": "117d96a04f007ce8fc2e292369056c3bd09f6f63",
"versionType": "git"
},
{
"lessThan": "c46d82c47afc968d6ee8ef4470fa2dd35b765c21",
"status": "affected",
"version": "117d96a04f007ce8fc2e292369056c3bd09f6f63",
"versionType": "git"
},
{
"lessThan": "3767c9f0c1bbd98dd25cb088356a0fc6c1f09f50",
"status": "affected",
"version": "117d96a04f007ce8fc2e292369056c3bd09f6f63",
"versionType": "git"
},
{
"lessThan": "4716a64b7cc2797741f7be4e283ace78a9dff37d",
"status": "affected",
"version": "117d96a04f007ce8fc2e292369056c3bd09f6f63",
"versionType": "git"
},
{
"lessThan": "db9cc9fd9660b2d69ee66f5a4cbec83c21a1c64d",
"status": "affected",
"version": "117d96a04f007ce8fc2e292369056c3bd09f6f63",
"versionType": "git"
},
{
"lessThan": "bbeae12fda3384a90fbebc8a19ba9d33f85b5361",
"status": "affected",
"version": "117d96a04f007ce8fc2e292369056c3bd09f6f63",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/osdmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: guard missing CRUSH type name lookup\n\nLocalized read selection can walk a parent bucket whose name exists in\nthe CRUSH map while its type has no matching entry in type_names.\nget_immediate_parent() then dereferences a NULL type_cn and passes an\ninvalid pointer into strcmp(), causing a null-ptr-deref.\n\nSkip such malformed parent buckets unless both the bucket name and type\nname metadata are present. This keeps malformed hierarchy data from\ncrashing locality lookup and safely falls back to \"not local\".\n\n[ idryomov: add WARN_ON_ONCE ]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Malformed CRUSH hierarchy data is delivered to the kernel Ceph client in CEPH_MSG_OSD_MAP over TCP from a monitor or OSD peer, stored in libceph, and later triggers get_immediate_parent() during localized-read target selection on RBD/CephFS client I/O.\nAC:L - A compromised or attacker-controlled Ceph monitor can publish an osdmap whose CRUSH buckets have names but missing type_names entries; once applied, the NULL dereference is reliably hit on subsequent localize-read calc_target() paths without further attacker-controlled timing.\nPR:N - Exploitation requires no privileges on the victim host; any machine acting as a kernel Ceph client that receives a forged osdmap from a cluster peer over the network can be attacked without local capabilities or user-namespace tricks.\nUI:N - No victim user action is needed at exploitation time beyond the host already being a Ceph client with localized reads enabled; forged osdmaps are applied automatically and the crash fires on subsequent kernel client read or map-rescan operations.\nS:U - Impact is confined to kernel memory on the Ceph client host (crash or potential escalation within that host); it does not cross VM, IOMMU, or sandbox boundaries to other security authorities.\nC:N - The failure is a NULL pointer dereference when accessing type_cn-\u003ecn_name; there is no out-of-bounds read, use-after-free, or other memory corruption that could disclose kernel data.\nI:N - The bug causes a NULL pointer dereference crash only; no attacker-controlled write, heap corruption, or control-flow hijack primitive is created by this defect.\nA:H - The NULL pointer dereference in get_immediate_parent() during CRUSH locality lookup causes a kernel oops or panic, denying all service on the affected Ceph client host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:30:27.540Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cbfcba275326c8c7dae9acd8f4a0d4c316fdafb0"
},
{
"url": "https://git.kernel.org/stable/c/8ff579ac03d6e9d17d6d9c8443110167c14a382d"
},
{
"url": "https://git.kernel.org/stable/c/6a4b75d90f0cfbf22c14742ab35a803bc13f36ec"
},
{
"url": "https://git.kernel.org/stable/c/c46d82c47afc968d6ee8ef4470fa2dd35b765c21"
},
{
"url": "https://git.kernel.org/stable/c/3767c9f0c1bbd98dd25cb088356a0fc6c1f09f50"
},
{
"url": "https://git.kernel.org/stable/c/4716a64b7cc2797741f7be4e283ace78a9dff37d"
},
{
"url": "https://git.kernel.org/stable/c/db9cc9fd9660b2d69ee66f5a4cbec83c21a1c64d"
},
{
"url": "https://git.kernel.org/stable/c/bbeae12fda3384a90fbebc8a19ba9d33f85b5361"
}
],
"title": "libceph: guard missing CRUSH type name lookup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68157",
"datePublished": "2026-08-10T11:59:23.692Z",
"dateReserved": "2026-07-30T09:28:09.371Z",
"dateUpdated": "2026-08-19T16:30:27.540Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…