CVE-2026-68154
libceph: reject zero bucket types in crush_decode
Description
In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crush_decode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crush_decode() accepts a bucket with type 0, a malformed CRUSH map can make the mapper treat a negative bucket ID as a device and pass it to is_out(), which then indexes the OSD weight array with a negative value. Reject zero bucket types while decoding the CRUSH map so the invalid state never reaches the mapper.
INFO
Published Date :
Aug. 10, 2026, 1:20 p.m.
Last Modified :
Aug. 17, 2026, 5:18 a.m.
Remotely Exploit :
Yes !
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Update the Linux kernel to resolve the CRUSH map decoding vulnerability.
- Ensure CRUSH maps do not contain zero bucket types.
- Validate CRUSH map integrity before processing.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-68154.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-68154 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-68154
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-68154 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-68154 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 17, 2026
Action Type Old Value New Value Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'f24e9980eb860d8600cbe5ef3d2fd9295320d229', 'lessThan': 'b8a9fb6bf806f9c4891e71ae1beab0c07c23a877', 'versionType': 'git'}, {'status': 'affected', 'version': 'f24e9980eb860d8600cbe5ef3d2fd9295320d229', 'lessThan': '826cd1de5802fd392922785f9b64d76e65d2a100', 'versionType': 'git'}, {'status': 'affected', 'version': 'f24e9980eb860d8600cbe5ef3d2fd9295320d229', 'lessThan': '3b2f1937f5fce8b7dd5432e7693e3cc8b5eece56', 'versionType': 'git'}, {'status': 'affected', 'version': 'f24e9980eb860d8600cbe5ef3d2fd9295320d229', 'lessThan': '70998f91030ee083ecb336a1dff0701c20a38081', 'versionType': 'git'}, {'status': 'affected', 'version': 'f24e9980eb860d8600cbe5ef3d2fd9295320d229', 'lessThan': '05f90284223381005d6bcddab3fda4a97f9c3401', 'versionType': 'git'}], 'programFiles': ['net/ceph/osdmap.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.34'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.34', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc5', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/ceph/osdmap.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'f24e9980eb860d8600cbe5ef3d2fd9295320d229', 'lessThan': 'b8a9fb6bf806f9c4891e71ae1beab0c07c23a877', 'versionType': 'git'}, {'status': 'affected', 'version': 'f24e9980eb860d8600cbe5ef3d2fd9295320d229', 'lessThan': '826cd1de5802fd392922785f9b64d76e65d2a100', 'versionType': 'git'}, {'status': 'affected', 'version': 'f24e9980eb860d8600cbe5ef3d2fd9295320d229', 'lessThan': '3b2f1937f5fce8b7dd5432e7693e3cc8b5eece56', 'versionType': 'git'}, {'status': 'affected', 'version': 'f24e9980eb860d8600cbe5ef3d2fd9295320d229', 'lessThan': '70998f91030ee083ecb336a1dff0701c20a38081', 'versionType': 'git'}, {'status': 'affected', 'version': 'f24e9980eb860d8600cbe5ef3d2fd9295320d229', 'lessThan': '05f90284223381005d6bcddab3fda4a97f9c3401', 'versionType': 'git'}], 'programFiles': ['net/ceph/osdmap.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.34'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.34', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/ceph/osdmap.c'], 'defaultStatus': 'affected'}] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 13, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 10, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'f24e9980eb860d8600cbe5ef3d2fd9295320d229', 'lessThan': 'b8a9fb6bf806f9c4891e71ae1beab0c07c23a877', 'versionType': 'git'}, {'status': 'affected', 'version': 'f24e9980eb860d8600cbe5ef3d2fd9295320d229', 'lessThan': '826cd1de5802fd392922785f9b64d76e65d2a100', 'versionType': 'git'}, {'status': 'affected', 'version': 'f24e9980eb860d8600cbe5ef3d2fd9295320d229', 'lessThan': '3b2f1937f5fce8b7dd5432e7693e3cc8b5eece56', 'versionType': 'git'}, {'status': 'affected', 'version': 'f24e9980eb860d8600cbe5ef3d2fd9295320d229', 'lessThan': '70998f91030ee083ecb336a1dff0701c20a38081', 'versionType': 'git'}, {'status': 'affected', 'version': 'f24e9980eb860d8600cbe5ef3d2fd9295320d229', 'lessThan': '05f90284223381005d6bcddab3fda4a97f9c3401', 'versionType': 'git'}], 'programFiles': ['net/ceph/osdmap.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.34'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.34', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc5', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/ceph/osdmap.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crush_decode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crush_decode() accepts a bucket with type 0, a malformed CRUSH map can make the mapper treat a negative bucket ID as a device and pass it to is_out(), which then indexes the OSD weight array with a negative value. Reject zero bucket types while decoding the CRUSH map so the invalid state never reaches the mapper. Added Reference https://git.kernel.org/stable/c/05f90284223381005d6bcddab3fda4a97f9c3401 Added Reference https://git.kernel.org/stable/c/3b2f1937f5fce8b7dd5432e7693e3cc8b5eece56 Added Reference https://git.kernel.org/stable/c/70998f91030ee083ecb336a1dff0701c20a38081 Added Reference https://git.kernel.org/stable/c/826cd1de5802fd392922785f9b64d76e65d2a100 Added Reference https://git.kernel.org/stable/c/b8a9fb6bf806f9c4891e71ae1beab0c07c23a877