Linux Kernel libceph net/ceph/osdmap.c __decode_pg_temp/__decode_pg_upmap_items out-of-bounds write

Summaryinfo

A vulnerability categorized as very critical has been discovered in Linux Kernel. This vulnerability affects the function __decode_pg_temp/__decode_pg_upmap_items of the file net/ceph/osdmap.c of the component libceph. Such manipulation leads to out-of-bounds write. This vulnerability is referenced as CVE-2026-68159. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in Linux Kernel (affected version unknown) and classified as very critical. Affected by this issue is the function __decode_pg_temp/__decode_pg_upmap_items of the file net/ceph/osdmap.c of the component libceph. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE __decode_pg_temp() decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPH_PG_MAX_SIZE. The helper backs both pg_temp and pg_upmap decoding, and apply_upmap()/get_temp_osds() later copy the decoded list into the fixed-size on-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE]. A monitor that sends an OSDMap with a pg_temp/pg_upmap entry longer than 32 thus causes a stack out-of-bounds write. An OSD set for a single PG can never exceed CEPH_PG_MAX_SIZE, so reject longer entries at decode time. The bound is well below the old overflow threshold, so it also covers the allocation-size overflow the previous check guarded against. BUG: KASAN: stack-out-of-bounds in ceph_pg_to_up_acting_osds Write of size 4 ... by task exploit kasan_report (mm/kasan/report.c:595) ceph_pg_to_up_acting_osds (net/ceph/osdmap.c:2617 net/ceph/osdmap.c:2833) calc_target (net/ceph/osd_client.c:1638) __submit_request (net/ceph/osd_client.c:2394) ceph_osdc_start_request (net/ceph/osd_client.c:2490) ceph_osdc_call (net/ceph/osd_client.c:5164) rbd_dev_image_probe (drivers/block/rbd.c:6899) do_rbd_add (drivers/block/rbd.c:7138) ... kernel BUG at net/ceph/osdmap.c:2670! [ idryomov: do the same in __decode_pg_upmap_items() ]

The advisory is shared for download at git.kernel.org. This vulnerability is handled as CVE-2026-68159 since 07/30/2026. The exploitation is known to be easy. The attack may be launched remotely. The exploitation requires an enhanced level of successful authentication. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 08/10/2026).

Applying the patch e36663145abd7024f0281dfb22fdef65f185845b/9f00f9cf2be293efe899db67dc5272e3a9c62717 is able to eliminate this problem.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion