CVE-2026-68159
Received Received - Intake

Stack Out-of-Bounds Write in Linux Kernel Ceph

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE __decode_pg_temp() decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPH_PG_MAX_SIZE. The helper backs both pg_temp and pg_upmap decoding, and apply_upmap()/get_temp_osds() later copy the decoded list into the fixed-size on-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE]. A monitor that sends an OSDMap with a pg_temp/pg_upmap entry longer than 32 thus causes a stack out-of-bounds write. An OSD set for a single PG can never exceed CEPH_PG_MAX_SIZE, so reject longer entries at decode time. The bound is well below the old overflow threshold, so it also covers the allocation-size overflow the previous check guarded against. BUG: KASAN: stack-out-of-bounds in ceph_pg_to_up_acting_osds Write of size 4 ... by task exploit kasan_report (mm/kasan/report.c:595) ceph_pg_to_up_acting_osds (net/ceph/osdmap.c:2617 net/ceph/osdmap.c:2833) calc_target (net/ceph/osd_client.c:1638) __submit_request (net/ceph/osd_client.c:2394) ceph_osdc_start_request (net/ceph/osd_client.c:2490) ceph_osdc_call (net/ceph/osd_client.c:5164) rbd_dev_image_probe (drivers/block/rbd.c:6899) do_rbd_add (drivers/block/rbd.c:7138) ... kernel BUG at net/ceph/osdmap.c:2670! [ idryomov: do the same in __decode_pg_upmap_items() ]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68159
EUVD
EUVD-2026-55545

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ceph libceph *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a stack out-of-bounds write in the libceph component. The issue occurs when decoding user-controlled length values for pg_temp, pg_upmap, or pg_upmap_items without properly bounding them to CEPH_PG_MAX_SIZE. This allows an attacker to send a maliciously crafted OSDMap with an entry longer than 32, causing a stack overflow during decoding and later operations.

Detection Guidance

This vulnerability is specific to the Linux kernel's libceph component and requires kernel-level access to detect. No direct network or system commands are provided in the context to detect this issue. Monitoring kernel logs for stack out-of-bounds errors or KASAN reports may indicate exploitation attempts.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by triggering a stack overflow. It specifically affects systems using the Linux kernel with the libceph component, potentially leading to system crashes or unauthorized access if exploited.

Mitigation Strategies

Apply the latest kernel patches or updates that address this vulnerability. Ensure your Linux kernel version includes the fix for the libceph stack out-of-bounds write issue. Monitor vendor advisories for updates related to CEPH_PG_MAX_SIZE bounds checking.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68159. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart