CVE-2026-68154

Received Received - Intake

libceph CRUSH Map Zero Bucket Type Validation Flaw

Publication date: 2026-08-10

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crush_decode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crush_decode() accepts a bucket with type 0, a malformed CRUSH map can make the mapper treat a negative bucket ID as a device and pass it to is_out(), which then indexes the OSD weight array with a negative value. Reject zero bucket types while decoding the CRUSH map so the invalid state never reaches the mapper.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-19

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68154

EUVD

EUVD-2026-55540

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the CRUSH map decoder (crush_decode) where bucket type 0, which should only represent devices, is incorrectly accepted. This can lead the mapper to treat a negative bucket ID as a device, causing it to index the OSD weight array with a negative value, potentially causing crashes or undefined behavior.

Detection Guidance

This vulnerability is specific to the Linux kernel's CRUSH map handling in Ceph. Detection requires checking kernel logs for CRUSH map parsing errors or examining the CRUSH map configuration for invalid bucket types. Use commands like dmesg | grep crush or ceph osd crush dump to inspect the CRUSH map.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service by crashing the system or corrupting data if they can provide a malformed CRUSH map. It primarily affects systems using the Linux kernel with Ceph storage, potentially leading to data unavailability or corruption.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a low-level Linux kernel component (CRUSH map handling in Ceph). However, if exploited, it could lead to data integrity issues or unauthorized access, which may indirectly impact compliance by compromising data security or availability.

Mitigation Strategies

Apply the latest Linux kernel update that includes the fix for this issue. Verify the CRUSH map does not contain any bucket types set to zero. Restart Ceph services after updating to ensure the changes take effect.

Hi! I’m here to help you understand CVE-2026-68154. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70