What is the CVSS score of EUVD-2026-55546?

EUVD-2026-55546 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate EUVD-2026-55546?

Within 24 hours, identify and inventory all Linux systems running CephFS client to determine exposure scope and criticality. Within 7 days, apply the available kernel patch to affected systems in non-production test environments first to validate system stability and CephFS connectivity. Within 30 days, complete patch rollout to all production systems and verify deployment across your infrastructure inventory.

Linux Kernel EUVD-2026-55546

| CVE-2026-68160 CRITICAL

Out-of-bounds Read (CWE-125)

2026-08-10 Linux

GHSA-prf2-r76g-87fc

Buffer Overflow Information Disclosure Linux Canonical

9.8

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Compromise or impersonate Ceph MDS
Delivery

Craft caps message hdr.version=1
Exploit

Set snap_trace_len 0xFFFFFFFF on IMPORT
Execution

Client decodes fake snap realm
Persist

Read kernel memory past front buffer
Impact

Leak data or panic client

Vulnerability Assessment

Weakness	CWE CWE-125 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, read limits MITRE ATT&CK 1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the target to be running the Linux CephFS kernel client and actively communicating with the attacker-controlled component - specifically a malicious or compromised Ceph MDS (or an on-path attacker able to forge MDS traffic). The concrete trigger is a ceph_mds_caps message carrying the CEPH_CAP_OP_IMPORT op with msg->hdr.version deliberately set to 1 (which bypasses the msg_version>=2 decoders) and an oversized snap_trace_len such as 0xFFFFFFFF. Limiting factors: the host must mount or be mounting CephFS, the attacker must sit in the client's server trust relationship, and the primitive is an out-of-bounds read (memory disclosure/DoS) rather than direct code execution. Hosts that never use CephFS are not exploitable regardless of the network-facing CVSS metric.
Impact	The raw CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) overstates real-world exposure and should be read critically. The attack is not a generic remote exploit against any Linux host: it requires the victim to be a CephFS client connected to a malicious or compromised MDS, so the practical threat model is a subverted storage cluster or a man-in-the-middle on the Ceph control plane, not an arbitrary internet attacker. The primary primitive is an out-of-bounds read, which realistically yields kernel memory disclosure and denial of service (panic) rather than the clean integrity/RCE impact the I:H metric implies - I would rate integrity impact lower than the feed's vector. Corroborating this, EPSS is only 0.22% (12th percentile), there is no CISA KEV listing and no public PoC, indicating no observed exploitation. That said, for any organization actually running CephFS at scale, a single compromised MDS can read kernel memory from every mounting client, so the blast radius within a Ceph deployment is significant and patching should not be deferred. The bottom line: high severity for CephFS operators, low priority for hosts that never mount CephFS.
Exploit ScenarioDerived	An attacker who has compromised a Ceph Metadata Server (or can impersonate one on the storage network) sends a crafted CEPH_CAP_OP_IMPORT caps message with hdr.version=1 and snap_trace_len=0xFFFFFFFF to a connected CephFS client. The client's ceph_update_snap_trace() decodes a bogus snap realm well past the message buffer, leaking adjacent kernel memory or panicking the host. No public PoC is currently known, and the network attack vector with low complexity means no user interaction is needed once the malicious server is in the client's trust path.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 14, 2026

Pre-authentication out-of-bounds kernel memory read in the Linux kernel's CephFS client (ceph_handle_caps) allows a malicious or compromised Ceph Metadata Server (MDS) to read beyond the message front buffer. By sending a CEPH_CAP_OP_IMPORT caps message with hdr.version set to 1 and an oversized snap_trace_len (e.g. 0xFFFFFFFF), the server bypasses all version-gated decoders and drives ceph_update_snap_trace() to decode a fake snap realm past the buffer, cascading into further OOB reads via attacker-controlled num_snaps/num_prior_parent_snaps counts. The flaw is present in every kernel since ceph_handle_caps() was introduced; it carries a CVSS 9.8 but currently has no public exploit and a low EPSS score (0.22%), and it is not on CISA KEV.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.6.148, 6.12.101, 6.18.42, 7.1.6, or 7.2-rc5 or later - or apply your distribution's backport (e.g. the Canonical/Ubuntu update). The upstream fixes are available as stable commits: https://git.kernel.org/stable/c/9081c71796724ffe96cba253f68fbe42363c5295, https://git.kernel.org/stable/c/03b417afce19ee6b6e61f1bbbbebac924c9f36d1, https://git.kernel.org/stable/c/a4228b93706fb74a484e6ffb271c1cc2af3a2ddb, https://git.kernel.org/stable/c/71893c342a26bcff92eaab0b2b75d64aed19308a, and https://git.kernel.org/stable/c/4dbc71bcaf9a30abf3920a4e2cc4ed33bba78c02. Where immediate patching is not possible, reduce exposure by ensuring CephFS clients only connect to trusted, hardened MDS nodes over authenticated cephx and network-isolated storage VLANs, and unmount CephFS on hosts that do not require it (side effect: those hosts lose CephFS access). Enabling cephx authentication and msgr2 secure mode raises the bar against MDS spoofing/MITM but does not protect against a genuinely compromised MDS, so patching remains the only complete fix.

Affected VersionsENISA

Linux patch: 0

Linux patch: 6.12.101

Linux patch: 7.1.6

Linux patch: 7.2-rc5

Linux patch: 6.6.148

Linux patch: 6.18.42

Linux a8599bd821d084d04a3290fffae1071624ec00ea <9081c71796724ffe96cba253f68fbe42363c5295

Linux a8599bd821d084d04a3290fffae1071624ec00ea <71893c342a26bcff92eaab0b2b75d64aed19308a

Linux a8599bd821d084d04a3290fffae1071624ec00ea <4dbc71bcaf9a30abf3920a4e2cc4ed33bba78c02

Linux a8599bd821d084d04a3290fffae1071624ec00ea <a4228b93706fb74a484e6ffb271c1cc2af3a2ddb

Linux 2.6.34

Linux a8599bd821d084d04a3290fffae1071624ec00ea <03b417afce19ee6b6e61f1bbbbebac924c9f36d1

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability lives in the kernel CephFS client, which speaks the Ceph wire protocol to a cluster's Metadata Servers. In ceph_handle_caps() the code reads snap_trace_len directly from the wire-format ceph_mds_caps header and builds an end pointer as snaptrace + snaptrace_len without validating that length against the actual msg->front buffer size. The eleven msg_version >= 2..12 decoder blocks that would normally catch this sit behind an hdr.version gate, so a message declaring version 1 skips all of them and reaches the op switch with an unvalidated length. This is a classic out-of-bounds read (CWE-125, though CWE is marked N/A in the feed) rooted in trusting an attacker-supplied length field; on 32-bit builds the naive p + snap_trace_len addition can also wrap the address space. The fix validates snap_trace_len with the canonical ceph_decode_need()/ceph_has_room() helper, which bounds via subtraction (n <= end - p) rather than pointer addition, making it wrap-safe.

Know when Canonical gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 9.1 CRITICAL

Remote malicious MDS needs no client-side auth (PR:N/AV:N/AC:L); OOB read yields kernel memory disclosure (C:H) and crashes (A:H) but no direct write, so I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE 8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Red Hat 7.0 HIGH

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Aug 13, 2026 - 23:37 NVD

9.8 (CRITICAL)

Patch available

Aug 10, 2026 - 14:18 EUVD

CVE Published

Aug 10, 2026 - 11:59 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 10, 2026 - 11:59 cve.org

CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()

ceph_handle_caps() reads snap_trace_len from the wire-format ceph_mds_caps header and uses it unconditionally to build a fake end pointer (snaptrace + snaptrace_len) that is later handed to ceph_update_snap_trace() in the CEPH_CAP_OP_IMPORT case:

snaptrace = h + 1; snaptrace_len = le32_to_cpu(h->snap_trace_len); p = snaptrace + snaptrace_len; ... case CEPH_CAP_OP_IMPORT: if (snaptrace_len) { ... if (ceph_update_snap_trace(mdsc, snaptrace, snaptrace + snaptrace_len, false, &realm)) { ... }

ceph_update_snap_trace() then decodes a struct ceph_mds_snap_realm from snaptrace using ceph_decode_need(&p, e, sizeof(*ri), bad) with the attacker-supplied fake end e snaptrace + snaptrace_len. With snaptrace_len 0xFFFFFFFF the bound check is trivially satisfied, ri = p reads sizeof(struct ceph_mds_snap_realm) past the legitimate msg->front buffer, and ri->num_snaps / ri->num_prior_parent_snaps then drive further out-of-bounds reads of the encoded snap arrays.

The eleven msg_version >= 2 .. msg_version >= 12 decoder blocks above the op switch each catch this OOB through their ceph_decode_*_safe() / ceph_decode_need() helpers, but they sit behind a hdr.version-gated if, so a malicious or compromised MDS that sets msg->hdr.version = 1 reaches the IMPORT path with no version-gated decoder having validated snap_trace_len. The shape has been present since ceph_handle_caps() was introduced.

Validate snap_trace_len against the message front buffer before consuming it, using the canonical ceph_decode_need() / ceph_has_room() helper. The helper bounds the length with subtraction (n <= end - p, guarded by end >= p) rather than pointer addition, so it is wrap-safe for the attacker-controlled u32 length on 32-bit builds where p + snap_trace_len could overflow the address space. This matches the rest of the ceph decode path (e.g. the pool_ns_len check a few lines below), and the existing goto bad cleanup already covers this exit path.

Executive ViewAI

Why It Matters

A critical kernel vulnerability in Linux CephFS client enables unauthorized memory disclosure from a compromised Ceph metadata server, potentially exposing encryption keys and sensitive credentials stored in kernel memory. Organizations using Ceph for distributed storage face data exposure risk if metadata infrastructure is infiltrated or compromised. Remediation requires patching all affected Linux systems.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 88% exploitable

Prevalence

Medium

Linux kernel is ubiquitous but the CephFS client runs only on hosts mounting CephFS

Threat Intel

1 sources

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS NEWS MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Canonical

View all

CVE-2011-3544 CRITICAL Act Now POC

9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug

CVE-2019-11043 CRITICAL Emergency POC

9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2014-6271 CRITICAL Act Now POC

9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

CVE-2013-0422 CRITICAL Emergency POC

9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using

CVE-2016-3714 HIGH Act Now POC

8.4 May 05

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.

CVE-2017-12617 HIGH Act Now POC

8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT

CVE-2016-8735 CRITICAL Act Now POC

9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8

CVE-2014-7169 CRITICAL Act Now POC

9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of

CVE-2014-0160 HIGH Act Now POC

7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

CVE-2016-5195 HIGH Act Now POC

7.0 Nov 10

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

CVE-2013-2423 LOW Act Now POC

3.7 Apr 17

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and

CVE-2023-4911 HIGH Act Now POC

7.8 Oct 03

Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected

Same weakness CWE-125 – Out-of-bounds Read

View all

CVE-2016-5198 HIGH POC

8.8

CVE-2025-5777 CRITICAL POC

9.3

CVE-2016-1646 HIGH POC

8.8

CVE-2017-5030 HIGH POC

8.8

CVE-2016-4523 HIGH

7.5

CVE-2024-48456 HIGH POC

7.5

CVE-2024-48457 HIGH POC

7.5

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back