Skip to main content

Linux Kernel CVE-2026-68155

| EUVDEUVD-2026-55541 HIGH
2026-08-10 Linux GHSA-2v58-jx7r-h3cm
Denial Of Service Linux Suse
7.5
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Network-delivered Ceph protocol message requires no prior auth; impact is purely availability via guaranteed kernel panic; no confidentiality or integrity loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.1 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 02:35 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
7.5 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 11:59 cve.org
HIGH 7.5
CVE Published
Aug 10, 2026 - 11:59 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

libceph: Reject monmaps advertising zero monitors

A message of type CEPH_MSG_MON_MAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the existing monitors in the cluster. Currently, a monmap indicating that there are zero monitors in the cluster is treated as valid. However, it is impossible to have zero monitors in the cluster and still receive a valid monmap from a monitor. Therefore, such a monmap must be corrupted and should be treated as invalid. Furthermore, a monmap with a monitor count of zero can subsequently crash the client when attempting to open a session with a monitor in __open_session(). This happens because the "BUG_ON(monc->monmap->num_mon < 1)" assertion in pick_new_mon() is triggered.

This patch extends a check in ceph_monmap_decode() to also reject arriving mon_maps with num_mon == 0 rather than only with num_mon > CEPH_MAX_MON.

[ idryomov: drop "log output for unusual values of num_mon" part ]

AnalysisAI

Kernel panic via crafted zero-monitor Ceph monmap in Linux libceph allows a network-reachable attacker to crash systems running the Ceph client. The libceph subsystem's ceph_monmap_decode() function fails to reject CEPH_MSG_MON_MAP messages advertising zero monitors - a logically impossible state, since no live monitor could emit such a map - accepting the corrupted payload as valid. Subsequent session establishment in __open_session() calls pick_new_mon(), where the hardcoded assertion BUG_ON(monc->monmap->num_mon < 1) triggers an immediate kernel panic. With EPSS at 0.20% (10th percentile) and no CISA KEV listing, large-scale exploitation is not currently observed, but the unauthenticated network-reachable CVSS vector makes this relevant for any environment running Ceph-attached Linux hosts.

Technical ContextAI

The libceph module is the Linux kernel's in-tree Ceph storage protocol client, used by systems mounting CephFS or using Ceph RBD (block devices). Monitors are authoritative coordinators in a Ceph cluster; clients receive CEPH_MSG_MON_MAP messages to learn the topology of available monitors. The decoding function ceph_monmap_decode() previously validated only the upper bound (num_mon > CEPH_MAX_MON) but not the lower bound (num_mon == 0). Because a monmap with zero monitors is physically impossible in a functioning cluster, its presence signals either corruption or a crafted/malicious message. The reachable assertion BUG_ON() in pick_new_mon() is not a graceful error path - in the Linux kernel it unconditionally triggers a kernel oops and system halt, constituting a complete denial of service. No CWE is formally assigned, but the root cause maps to CWE-20 (Improper Input Validation) and the impact mechanism to CWE-617 (Reachable Assertion). Affected CPE: cpe:2.3:a:linux:linux across all stable branches up to the fixed versions.

RemediationAI

The primary fix is upgrading to a patched kernel version: 6.6.148, 6.12.101, 6.18.42, or 7.1.6 (stable), or 7.2-rc5 (mainline). Upstream fix commits are available at the kernel.org stable tree references provided. Distribution maintainers should be tracked for backported packages. If an immediate kernel update is not feasible, compensating controls include restricting network access to the Ceph monitor port (default TCP 6789 and msgr2 port 3300) so that only legitimate monitors and clients on trusted network segments can exchange Ceph protocol messages - this does not eliminate the flaw but removes untrusted parties from the attack surface. Disabling the libceph module is not practical on systems actively using Ceph storage. Note that the patch adds a single boundary check in ceph_monmap_decode() with negligible performance impact. Vendor advisory referenced via NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-68155.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-68155 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy