CVE-2026-68154 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
libceph: reject zero bucket types in crush_decode
CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices.
If crush_decode() accepts a bucket with type 0, a malformed CRUSH map can make the mapper treat a negative bucket ID as a device and pass it to is_out(), which then indexes the OSD weight array with a negative value.
Reject zero bucket types while decoding the CRUSH map so the invalid state never reaches the mapper.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability in question affects the Linux kernel's ceph storage subsystem, specifically within the crush_decode function that processes CRUSH (Controlled Replication Under Scalable Hashing) maps used for data distribution. This issue represents a critical input validation flaw that can lead to arbitrary code execution or system instability. The CRUSH algorithm is fundamental to Ceph's distributed storage architecture, determining how data is replicated and distributed across the storage cluster. When a malformed CRUSH map contains a bucket with type 0, which should be reserved exclusively for device identifiers according to the CRUSH specification, the system fails to properly validate this input before processing.
The technical flaw stems from insufficient validation within the crush_decode() function, which accepts bucket type 0 values that violate the established invariant. In CRUSH terminology, bucket type 0 is specifically designated for leaf devices and cannot be used for intermediate bucket structures in the hierarchy. When this constraint is violated, the mapper component attempts to process what it believes to be a valid bucket identifier but actually represents a negative value due to the special handling of type 0. This creates a critical condition where the is_out() function receives an invalid parameter that causes it to index into the OSD weight array using a negative offset.
The operational impact of this vulnerability extends beyond simple data corruption, as it can enable attackers with access to modify CRUSH maps to potentially execute arbitrary code or cause denial of service conditions. The vulnerability manifests when a maliciously crafted CRUSH map is loaded into the system, bypassing normal validation mechanisms. This allows an attacker to manipulate the storage cluster's behavior by causing invalid memory accesses that could lead to kernel panics or more severe exploitation opportunities. The issue directly violates the principle of least privilege and input validation, creating a pathway for attackers to exploit the trust placed in legitimate CRUSH map processing.
Security mitigations for this vulnerability should focus on immediate input validation within the crush_decode() function to reject any bucket type 0 values during CRUSH map parsing. This approach aligns with CWE-252, which addresses insufficient validation of the return value of a function, and follows ATT&CK technique T1059.005 for command and scripting interpreter execution. The fix implements defensive programming practices by preventing invalid states from propagating to downstream components, ensuring that the mapper never encounters malformed bucket type values. Regular monitoring of CRUSH map integrity and implementing proper access controls for map modification should also be enforced as additional safeguards. Organizations should prioritize patching this vulnerability promptly, as it represents a critical security risk in distributed storage environments where unauthorized modifications to CRUSH maps could compromise entire storage clusters.