Skip to main content

Linux Kernel EUVDEUVD-2026-55545

| CVE-2026-68159 CRITICAL
2026-08-10 Linux GHSA-83x9-86wr-8vh2
Buffer Overflow Linux
9.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.1 HIGH

Network vector but AC:H because the attacker must control or impersonate a trusted Ceph monitor; kernel stack corruption yields high C/I/A via potential code execution.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Red Hat
8.8 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 02:37 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
9.8 (CRITICAL)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 11:59 cve.org
CRITICAL 9.8
CVE Published
Aug 10, 2026 - 11:59 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE

__decode_pg_temp() decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPH_PG_MAX_SIZE. The helper backs both pg_temp and pg_upmap decoding, and apply_upmap()/get_temp_osds() later copy the decoded list into the fixed-size on-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE]. A monitor that sends an OSDMap with a pg_temp/pg_upmap entry longer than 32 thus causes a stack out-of-bounds write.

An OSD set for a single PG can never exceed CEPH_PG_MAX_SIZE, so reject longer entries at decode time. The bound is well below the old overflow threshold, so it also covers the allocation-size overflow the previous check guarded against.

BUG: KASAN: stack-out-of-bounds in ceph_pg_to_up_acting_osds Write of size 4 ... by task exploit kasan_report (mm/kasan/report.c:595) ceph_pg_to_up_acting_osds (net/ceph/osdmap.c:2617 net/ceph/osdmap.c:2833) calc_target (net/ceph/osd_client.c:1638) __submit_request (net/ceph/osd_client.c:2394) ceph_osdc_start_request (net/ceph/osd_client.c:2490) ceph_osdc_call (net/ceph/osd_client.c:5164) rbd_dev_image_probe (drivers/block/rbd.c:6899) do_rbd_add (drivers/block/rbd.c:7138) ... kernel BUG at net/ceph/osdmap.c:2670!

[ idryomov: do the same in __decode_pg_upmap_items() ]

AnalysisAI

Stack out-of-bounds write in the Linux kernel's libceph client (net/ceph/osdmap.c) allows a malicious or compromised Ceph monitor to corrupt kernel stack memory on any client that mounts cephfs or maps RBD storage. The __decode_pg_temp() and __decode_pg_upmap_items() helpers accepted an attacker-controlled OSD-set length without bounding it to CEPH_PG_MAX_SIZE (32), so an oversized pg_temp/pg_upmap entry in an OSDMap is copied into the fixed-size on-stack ceph_osds.osds[32] array, triggering a KASAN-confirmed stack overflow that can panic the kernel and potentially enable privilege escalation. No public exploit identified at time of analysis; EPSS is low (0.20%) and it is not on the CISA KEV list.

Technical ContextAI

The affected component is libceph, the in-kernel client library used by the Ceph filesystem (cephfs) and the RADOS block device (rbd). Ceph clients receive OSDMaps from cluster monitors describing data placement across OSDs. During OSDMap decoding, __decode_pg_temp() reads a caller-supplied 'len' for a placement group's OSD set and previously only rejected values large enough to overflow the kmalloc allocation, never enforcing the protocol invariant that an OSD set for a single PG cannot exceed CEPH_PG_MAX_SIZE (32). The same helper backs pg_upmap decoding, and __decode_pg_upmap_items() had the equivalent flaw. Later, apply_upmap() and get_temp_osds() copy the decoded list into struct ceph_osds, whose osds[] member is a fixed 32-element array on the kernel stack, so a longer list writes past the bounds. This is a stack out-of-bounds/buffer overflow (CWE-787 / CWE-121); the feed lists CWE as N/A, but the description and the 'Buffer Overflow' tag make the class explicit. The fix rejects any entry longer than CEPH_PG_MAX_SIZE at decode time, which also subsumes the older allocation-overflow guard.

RemediationAI

Upstream fix available (commits e36663145abd7024f0281dfb22fdef65f185845b and 9f00f9cf2be293efe899db67dc5272e3a9c62717 at https://git.kernel.org/stable/c/e36663145abd7024f0281dfb22fdef65f185845b and https://git.kernel.org/stable/c/9f00f9cf2be293efe899db67dc5272e3a9c62717); update to a kernel that includes them, such as stable 7.1.6 or 7.2-rc5 or your distribution's patched backport, then reboot to load the fixed kernel. Where immediate patching is not possible, reduce exposure by ensuring Ceph clients connect only to trusted monitors over an authenticated, integrity-protected channel: enable and require cephx authentication and Ceph messenger v2 encryption (ms_client_mode=secure) so a network attacker cannot impersonate a monitor to inject a malicious OSDMap, and place monitor traffic on a segmented management network rather than a shared or untrusted one. If cephfs/rbd is not needed on a host, unload or blacklist the ceph and rbd modules to remove the attack surface entirely; the trade-off is loss of Ceph storage access on that host, and the encryption/segmentation controls only mitigate untrusted-network attackers, not an already-compromised legitimate monitor, so patching remains the definitive fix.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-55545 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy