CVE-2026-68155 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
libceph: Reject monmaps advertising zero monitors
A message of type CEPH_MSG_MON_MAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the existing monitors in the cluster. Currently, a monmap indicating that there are zero monitors in the cluster is treated as valid. However, it is impossible to have zero monitors in the cluster and still receive a valid monmap from a monitor. Therefore, such a monmap must be corrupted and should be treated as invalid. Furthermore, a monmap with a monitor count of zero can subsequently crash the client when attempting to open a session with a monitor in __open_session(). This happens because the "BUG_ON(monc->monmap->num_mon < 1)" assertion in pick_new_mon() is triggered.
This patch extends a check in ceph_monmap_decode() to also reject arriving mon_maps with num_mon == 0 rather than only with num_mon > CEPH_MAX_MON.
[ idryomov: drop "log output for unusual values of num_mon" part ]
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability described represents a critical flaw in the Linux kernel's ceph client implementation that affects the libceph subsystem responsible for communication with ceph monitor clusters. This issue stems from insufficient validation of monitor map data structures that are exchanged between ceph monitors and clients during cluster coordination. The core problem manifests when a monitor sends a monmap message containing zero monitors, which violates fundamental cluster architecture principles and creates exploitable conditions for denial-of-service attacks.
The technical flaw exists within the ceph_monmap_decode() function where the validation logic fails to properly reject malformed monitor maps indicating zero monitors in the cluster. According to CWE-20, this represents a classic input validation vulnerability where the system accepts invalid data that should never occur in legitimate operations. The current implementation only validates that the monitor count exceeds CEPH_MAX_MON but neglects to check for the logically impossible scenario of zero monitors, creating a gap in the security boundary. This oversight allows attackers to craft malicious monmap messages that appear valid to the network layer but contain structurally invalid cluster topology information.
The operational impact of this vulnerability is severe as it can cause immediate client crashes and system instability throughout the ceph storage cluster. When a client receives a monmap indicating zero monitors, subsequent session establishment attempts trigger a kernel-level assertion failure in the pick_new_mon() function at line __open_session(). The BUG_ON(monc->monmap->num_mon < 1) check becomes active and causes a kernel panic, effectively terminating client operations and potentially disrupting data access for applications relying on the ceph storage system. This vulnerability directly maps to ATT&CK technique T1499.004 which involves network denial of service attacks against storage systems, and T1562.001 which encompasses privilege escalation through kernel exploitation.
The fix implemented in this patch addresses the root cause by extending the validation logic within ceph_monmap_decode() to explicitly reject monmaps where num_mon equals zero, in addition to the existing validation for values exceeding CEPH_MAX_MON. This mitigation prevents malformed monitor maps from being processed further in the client stack and ensures that only logically valid cluster topology information is accepted. The resolution follows security best practices by implementing defensive programming techniques that validate all input data against expected constraints before processing, thereby preventing cascading failures that could otherwise lead to system crashes or unauthorized access. Organizations should prioritize patching this vulnerability as it represents a potential vector for persistent denial-of-service attacks against ceph storage infrastructure and could enable more sophisticated exploitation attempts targeting the kernel's memory management subsystem.
The broader implications of this vulnerability highlight the importance of comprehensive input validation in distributed systems where malformed data can originate from network communications rather than local sources. This flaw demonstrates how seemingly minor validation gaps can create significant security risks in complex storage architectures, particularly when operating under high availability requirements where system stability is paramount. The vulnerability also underscores the need for robust error handling in kernel modules that process external data, as these components form critical pathways for cluster coordination and client communication within distributed storage environments.