Skip to main content

Linux Kernel CVE-2026-68157

| EUVDEUVD-2026-55543 HIGH
2026-08-10 Linux GHSA-mr29-956m-24vp
Denial Of Service Linux Suse
7.5
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.9 MEDIUM

Network vector correct but AC:H required - attacker must control Ceph monitor or execute MITM on authenticated cluster TCP; no confidentiality or integrity impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 02:36 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
7.5 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 11:59 cve.org
HIGH 7.5
CVE Published
Aug 10, 2026 - 11:59 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

libceph: guard missing CRUSH type name lookup

Localized read selection can walk a parent bucket whose name exists in the CRUSH map while its type has no matching entry in type_names. get_immediate_parent() then dereferences a NULL type_cn and passes an invalid pointer into strcmp(), causing a null-ptr-deref.

Skip such malformed parent buckets unless both the bucket name and type name metadata are present. This keeps malformed hierarchy data from crashing locality lookup and safely falls back to "not local".

[ idryomov: add WARN_ON_ONCE ]

AnalysisAI

Null pointer dereference in the Linux kernel's libceph client crashes affected hosts processing malformed CRUSH map data from a Ceph cluster. Specifically, get_immediate_parent() during localized read selection fails to validate that a parent bucket's type has a corresponding entry in type_names before dereferencing type_cn, which may be NULL when the CRUSH map contains an incomplete hierarchy. Any Linux host acting as a Ceph client - including Kubernetes nodes with Ceph-backed persistent volumes and OpenStack compute nodes - is vulnerable to a kernel panic triggerable by a party controlling or compromising the upstream Ceph cluster. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.20% (10th percentile), but the network-accessible crash path and the wide deployment of Ceph in enterprise environments make patching a practical priority.

Technical ContextAI

libceph is the in-kernel Ceph client library (ceph.ko) used by Linux systems mounting Ceph RBD block devices or CephFS filesystems. The CRUSH (Controlled Replication Under Scalable Hashing) algorithm determines data placement and locality by walking a hierarchical bucket tree received from Ceph monitors over the network. get_immediate_parent() traverses this tree to implement localized reads (preferring replicas near the client). The root cause is a missing null-guard: when a parent bucket's type ID exists in the CRUSH map but has no associated string in the type_names lookup table, the returned type_cn pointer is NULL. The code then passes this NULL directly into strcmp(), triggering a null-ptr-deref. CWE is not formally assigned in the input, but this is a textbook CWE-476 (NULL Pointer Dereference). The fix adds a guard to skip malformed parent buckets lacking both bucket name and type name metadata, safely falling back to 'not local', and adds WARN_ON_ONCE to surface the malformed map condition. The vulnerability was introduced at commit 117d96a04f007ce8fc2e292369056c3bd09f6f63, traceable to Linux 5.8.

RemediationAI

The primary fix is to upgrade the Linux kernel to a patched stable release: 6.6.148 or later for the 6.6 LTS branch, 6.12.101 or later for the 6.12 LTS branch, 6.18.42 or later for the 6.18 branch, or 7.1.6 or later for mainline. Patch commits are available at https://git.kernel.org/stable/c/3767c9f0c1bbd98dd25cb088356a0fc6c1f09f50 (6.6.x), https://git.kernel.org/stable/c/db9cc9fd9660b2d69ee66f5a4cbec83c21a1c64d (6.12.x), https://git.kernel.org/stable/c/bbeae12fda3384a90fbebc8a19ba9d33f85b5361 (6.18.x), https://git.kernel.org/stable/c/4716a64b7cc2797741f7be4e283ace78a9dff37d (7.1.x), and https://git.kernel.org/stable/c/c46d82c47afc968d6ee8ef4470fa2dd35b765c21 (mainline). If immediate kernel upgrade is not possible, the most effective compensating control is to ensure that Ceph monitor network communication is restricted to trusted infrastructure VLANs and that the libceph or rbd/ceph modules are unloaded on hosts that do not require Ceph client functionality (rmmod rbd ceph libceph); however, unloading will disrupt Ceph-backed workloads. Hardening Ceph monitor TLS authentication to prevent MITM injection of malformed CRUSH maps reduces the network attack surface without service disruption.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-68157 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy