CVE-2026-68159 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
__decode_pg_temp() decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPH_PG_MAX_SIZE. The helper backs both pg_temp and pg_upmap decoding, and apply_upmap()/get_temp_osds() later copy the decoded list into the fixed-size on-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE]. A monitor that sends
an OSDMap with a pg_temp/pg_upmap entry longer than 32 thus causes a stack out-of-bounds write.
An OSD set for a single PG can never exceed CEPH_PG_MAX_SIZE, so reject longer entries at decode time. The bound is well below the old overflow threshold, so it also covers the allocation-size overflow the previous check guarded against.
BUG: KASAN: stack-out-of-bounds in ceph_pg_to_up_acting_osds Write of size 4 ... by task exploit kasan_report (mm/kasan/report.c:595) ceph_pg_to_up_acting_osds (net/ceph/osdmap.c:2617 net/ceph/osdmap.c:2833) calc_target (net/ceph/osd_client.c:1638) __submit_request (net/ceph/osd_client.c:2394) ceph_osdc_start_request (net/ceph/osd_client.c:2490) ceph_osdc_call (net/ceph/osd_client.c:5164) rbd_dev_image_probe (drivers/block/rbd.c:6899) do_rbd_add (drivers/block/rbd.c:7138) ... kernel BUG at net/ceph/osdmap.c:2670!
[ idryomov: do the same in __decode_pg_upmap_items() ]
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability resides within the Linux kernel's Ceph storage subsystem, specifically in the libceph library responsible for handling OSD (Object Storage Daemon) map operations. This issue manifests as a stack-based buffer overflow that occurs during the decoding of pg_temp and pg_upmap entries within the OSDMap protocol. The flaw stems from insufficient input validation where the __decode_pg_temp() function processes user-controllable data without enforcing proper bounds checking against the maximum allowed size for these structures.
The technical implementation flaw involves the decode helper functions that handle both pg_temp and pg_upmap decoding operations, which later feed into fixed-size on-stack arrays defined by CEPH_PG_MAX_SIZE. This creates a scenario where an attacker-controlled monitor node could craft malicious OSDMap entries with pg_temp/pg_upmap values exceeding 32 elements, causing a stack out-of-bounds write when the data gets copied into the struct ceph_osds.osds[CEPH_PG_MAX_SIZE] array. The vulnerability's exploitation path begins at the decoding stage and culminates in kernel memory corruption during the ceph_pg_to_up_acting_osds function call.
The operational impact of this vulnerability is severe as it enables a remote code execution attack vector through a malicious monitor node that can manipulate OSDMap data structures. The stack overflow occurs at line 2670 in net/ceph/osdmap.c where kernel memory corruption leads to system instability and potential privilege escalation. According to the ATT&CK framework, this represents a privilege escalation technique through kernel memory corruption (T1068) and remote code execution via network protocol manipulation (T1190). The vulnerability also maps to CWE-121 Stack-based Buffer Overflow (CWE-121) and CWE-787 Out-of-bounds Write (CWE-787), with the specific manifestation being a kernel stack buffer overflow that can be triggered through network communication protocols.
The mitigation strategy involves implementing strict bounds checking during the decoding phase to ensure that pg_temp and pg_upmap entries never exceed CEPH_PG_MAX_SIZE, which serves as both a security boundary and operational constraint. The fix requires modifying __decode_pg_temp() and __decode_pg_upmap_items() functions to reject values larger than the defined maximum size, effectively preventing the overflow condition while maintaining backward compatibility with legitimate operations. This approach addresses not only the immediate stack buffer overflow but also covers the underlying allocation-size overflow that was previously protected against, creating a more robust defense-in-depth mechanism. The solution aligns with security best practices by implementing input validation at the earliest possible stage in the data processing pipeline and follows the principle of least privilege by ensuring all user-controllable inputs are properly bounded before being processed in kernel memory contexts.