Skip to main content

Linux Kernel CVE-2026-68158

| EUVDEUVD-2026-55544 CRITICAL
2026-08-10 Linux GHSA-jg8v-h49p-mvhw
Buffer Overflow Linux Suse
Critical
Disputed · 9.8 Vendor: Linux
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.2 HIGH

Network-reachable via Ceph messaging with low complexity and no victim auth, but the flaw is an OOB read, so availability (crash) is high, confidentiality low, and integrity none.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Red Hat
7.0 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 01:34 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
9.8 (CRITICAL)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 11:59 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 10, 2026 - 11:59 cve.org
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

libceph: Fix multiplication overflow in decode_new_up_state_weight()

If a message of type CEPH_MSG_OSD_MAP contains a (maliciously) corrupted osdmap, out-of-bounds memory accesses may occur in decode_new_up_state_weight(). This happens because the bounds check for the new_state part is based on calculating its length depending on a len value read from the incoming message. This calculation may overflow leading to an incorrect bounds check. Subsequently, out-of-bounds reads may occur when decoding this part.

This patch switches the multiplication to use check_mul_overflow() to abort processing the osdmap if an overflow occurred. Therefore, osdmaps/messages containing large values for len that result in a multiplication overflow are treated as invalid.

[ idryomov: rename new_state_len -> new_state_item_size, formatting ]

AnalysisAI

Out-of-bounds memory read in the Linux kernel's in-kernel Ceph client (libceph) allows a malicious or compromised Ceph monitor/OSD to crash or potentially leak kernel memory from any host mounting CephFS or RBD. The flaw lives in decode_new_up_state_weight() when parsing a CEPH_MSG_OSD_MAP message: an attacker-controlled length field feeds a multiplication used for a bounds check, and the overflow makes the check pass so the decoder reads past the buffer. EPSS is low (0.20%, 10th percentile) with no public exploit identified at time of analysis; the CVSS 9.8 appears inflated for what is fundamentally an OOB read reachable only from the Ceph messaging path.

Technical ContextAI

libceph is the shared kernel module underpinning the RBD block driver (krbd) and the CephFS kernel client; it decodes OSD map updates pushed by Ceph monitors. The root cause is an integer/multiplication overflow (CWE-190) feeding a bounds computation, which enables an out-of-bounds read (CWE-125) - the input lists CWE as N/A and tags it 'Buffer Overflow'. The affected routine calculates the new_state region length as (item count × item size) derived from a len value in the wire message; on 32/64-bit multiplication overflow the product wraps to a small value, the length check succeeds, and subsequent decoding walks off the end of the message buffer. The fix replaces the raw multiply with check_mul_overflow() so an overflowing osdmap is rejected as invalid (the patch also renames new_state_len to new_state_item_size).

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.6.148, 6.12.101, 6.18.42, 7.1.6 or later (mainline 7.2-rc5), applying the check_mul_overflow() fix from the git.kernel.org/stable commits listed in the references, via your distribution's kernel package. Where immediate patching is not possible, reduce exposure by ensuring kernel Ceph clients only connect to trusted, authenticated Ceph clusters: enable and enforce cephx authentication and Ceph messenger v2 with encryption (ms_client_mode=secure) so untrusted parties cannot inject or tamper with OSD map messages, and network-segment/firewall the Ceph monitor and OSD ports (typically 3300 and 6789, plus the 6800-7300 OSD range) so only cluster peers can reach clients - the trade-off is that secure-mode messaging adds CPU overhead and strict segmentation complicates multi-tenant or cross-subnet Ceph access. If the host does not need kernel CephFS/RBD, unloading the ceph/rbd/libceph modules removes the attack surface entirely at the cost of losing kernel-mode Ceph mounts.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-68158 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy