CVE-2026-68433

Received Received - Intake

libceph Memory Corruption in Kernel

Publication date: 2026-08-12

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: libceph: bound get_version reply decode to front len handle_get_version_reply() uses msg->front_alloc_len as the decode boundary for MON_GET_VERSION_REPLY. That is the size of the reused reply buffer, not the number of bytes actually received. A truncated reply can therefore pass ceph_decode_need() and decode the second u64 from stale tail bytes left in the buffer by an earlier message, causing an uninitialized memory read. Use msg->front.iov_len as the receive-side decode boundary, matching other libceph reply handlers and limiting decoding to the bytes that were actually read from the wire.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-19

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-68433

EUVD

EUVD-2026-57041

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the libceph component where a function incorrectly uses the size of a reused reply buffer instead of the actual received data size to decode a message. This can lead to reading uninitialized memory when a truncated reply passes validation checks.

Detection Guidance

This vulnerability is specific to the Linux kernel's libceph component and involves improper handling of network reply messages. Detection typically requires checking kernel logs for memory corruption errors or crashes related to ceph operations. No direct commands are provided in the context to detect this issue.

Impact Analysis

An attacker could exploit this to read sensitive memory contents, potentially exposing confidential data or causing system instability. Systems using libceph for Ceph storage operations are at risk if the kernel is unpatched.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating confidentiality requirements in GDPR and HIPAA. Organizations must patch systems to maintain compliance with data protection standards.

Mitigation Strategies

Apply the latest kernel updates that include the fix for this issue. The vulnerability is resolved by using the correct decode boundary (msg->front.iov_len) in libceph. Monitor kernel security advisories for patches and update affected systems promptly.

Hi! I’m here to help you understand CVE-2026-68433. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70