What is the CVSS score of CVE-2026-68154?

CVE-2026-68154 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-68154?

CVE-2026-68154 creates a kernel stability and data security risk for organizations running Ceph distributed storage infrastructure.. A patch is available.

How to fix or mitigate CVE-2026-68154?

Within 24 hours, identify all Linux systems running the Ceph client and assess exposure based on whether they connect to untrusted cluster sources. Within 7 days, apply the available vendor patch to all affected systems, prioritizing production Ceph nodes and cluster clients, and validate cluster stability after patching. Within 30 days, confirm complete patch deployment across the infrastructure and implement ongoing monitoring for CRUSH map processing anomalies.

Linux Kernel CVE-2026-68154

EUVD-2026-55540 CRITICAL

2026-08-10 Linux

GHSA-33w3-5969-wxfc

Information Disclosure Linux Suse

Critical

Disputed · 9.8 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.5 MEDIUM

Requires the client to process an attacker-controlled CRUSH map (AC:H), no auth or UI on the victim (PR:N/UI:N); out-of-bounds read causes crash (A:H) and limited memory disclosure (C:L), no integrity impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

7.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 02:34 vuln.today

CVSS changed

Aug 13, 2026 - 23:37 NVD

9.8 (CRITICAL)

Patch available

Aug 10, 2026 - 14:18 EUVD

CVE Published

Aug 10, 2026 - 11:59 cve.org

CRITICAL 9.8

CVE Published

Aug 10, 2026 - 11:59 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

libceph: reject zero bucket types in crush_decode

CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices.

If crush_decode() accepts a bucket with type 0, a malformed CRUSH map can make the mapper treat a negative bucket ID as a device and pass it to is_out(), which then indexes the OSD weight array with a negative value.

Reject zero bucket types while decoding the CRUSH map so the invalid state never reaches the mapper.

AnalysisAI

Out-of-bounds memory access in the Linux kernel's libceph client (crush_decode) lets a malformed CRUSH map drive the CRUSH mapper into indexing the OSD weight array with a negative value. Because bucket type 0 is reserved for leaf devices, a bucket wrongly decoded with type 0 causes a negative bucket ID to be treated as a device and passed to is_out(), yielding an out-of-bounds read that can leak kernel memory or crash the host. Exploitation requires the kernel Ceph client to process the crafted map (i.e., connection to a malicious or compromised Ceph cluster); there is no public exploit identified at time of analysis and EPSS is low (0.20%).

Technical ContextAI

The affected component is libceph, the in-kernel Ceph client shared by CephFS and RBD (Rados Block Device). CRUSH (Controlled Replication Under Scalable Hashing) is Ceph's deterministic data-placement algorithm; the kernel receives and decodes the cluster's CRUSH map, then uses the CRUSH mapper to compute object-to-OSD placement. The map is a tree of 'buckets' where bucket type 0 is a reserved sentinel that the mapper uses to distinguish leaf devices (OSDs) from internal buckets. crush_decode() failed to enforce this invariant, so a bucket decoded with type 0 collapses the device/bucket distinction. The root cause is an out-of-bounds read (CWE-125): a negative bucket ID is used to index the OSD weight array in is_out(). CWE was listed as N/A in the feed but the description clearly describes a negative-index array read.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.6.148, 6.12.101, 7.1.6, or 6.18.42 (mainline fix in 7.2-rc5), which makes crush_decode() reject zero bucket types so the invalid state never reaches the mapper. Apply the distribution kernel update that backports commits b8a9fb6bf806f9c4891e71ae1beab0c07c23a877 / 826cd1de5802fd392922785f9b64d76e65d2a100 / 3b2f1937f5fce8b7dd5432e7693e3cc8b5eece56 / 70998f91030ee083ecb336a1dff0701c20a38081 / 05f90284223381005d6bcddab3fda4a97f9c3401 (see git.kernel.org and the NVD advisory). If you cannot patch immediately, reduce exposure by ensuring the kernel Ceph client only connects to trusted monitors - restrict Ceph monitor/OSD traffic to a dedicated storage network, enforce cephx authentication and, where supported, msgr2 secure mode to prevent map tampering in transit, and avoid mounting CephFS/RBD from untrusted or attacker-controllable clusters; the trade-off is operational constraint on where clients may connect. On hosts that do not need Ceph, unloading/blacklisting the ceph and libceph modules removes the attack surface entirely at the cost of Ceph functionality.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-68154 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-68154

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code