GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-68157 (GCVE-0-2026-68157)

Vulnerability from cvelistv5 – Published: 2026-08-10 11:59 – Updated: 2026-08-19 16:30
VLAI
Title
libceph: guard missing CRUSH type name lookup
Summary
In the Linux kernel, the following vulnerability has been resolved: libceph: guard missing CRUSH type name lookup Localized read selection can walk a parent bucket whose name exists in the CRUSH map while its type has no matching entry in type_names. get_immediate_parent() then dereferences a NULL type_cn and passes an invalid pointer into strcmp(), causing a null-ptr-deref. Skip such malformed parent buckets unless both the bucket name and type name metadata are present. This keeps malformed hierarchy data from crashing locality lookup and safely falls back to "not local". [ idryomov: add WARN_ON_ONCE ]
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 117d96a04f007ce8fc2e292369056c3bd09f6f63 , < cbfcba275326c8c7dae9acd8f4a0d4c316fdafb0 (git)
Affected: 117d96a04f007ce8fc2e292369056c3bd09f6f63 , < 8ff579ac03d6e9d17d6d9c8443110167c14a382d (git)
Affected: 117d96a04f007ce8fc2e292369056c3bd09f6f63 , < 6a4b75d90f0cfbf22c14742ab35a803bc13f36ec (git)
Affected: 117d96a04f007ce8fc2e292369056c3bd09f6f63 , < c46d82c47afc968d6ee8ef4470fa2dd35b765c21 (git)
Affected: 117d96a04f007ce8fc2e292369056c3bd09f6f63 , < 3767c9f0c1bbd98dd25cb088356a0fc6c1f09f50 (git)
Affected: 117d96a04f007ce8fc2e292369056c3bd09f6f63 , < 4716a64b7cc2797741f7be4e283ace78a9dff37d (git)
Affected: 117d96a04f007ce8fc2e292369056c3bd09f6f63 , < db9cc9fd9660b2d69ee66f5a4cbec83c21a1c64d (git)
Affected: 117d96a04f007ce8fc2e292369056c3bd09f6f63 , < bbeae12fda3384a90fbebc8a19ba9d33f85b5361 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.8
Unaffected: 0 , < 5.8 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ceph/osdmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cbfcba275326c8c7dae9acd8f4a0d4c316fdafb0",
              "status": "affected",
              "version": "117d96a04f007ce8fc2e292369056c3bd09f6f63",
              "versionType": "git"
            },
            {
              "lessThan": "8ff579ac03d6e9d17d6d9c8443110167c14a382d",
              "status": "affected",
              "version": "117d96a04f007ce8fc2e292369056c3bd09f6f63",
              "versionType": "git"
            },
            {
              "lessThan": "6a4b75d90f0cfbf22c14742ab35a803bc13f36ec",
              "status": "affected",
              "version": "117d96a04f007ce8fc2e292369056c3bd09f6f63",
              "versionType": "git"
            },
            {
              "lessThan": "c46d82c47afc968d6ee8ef4470fa2dd35b765c21",
              "status": "affected",
              "version": "117d96a04f007ce8fc2e292369056c3bd09f6f63",
              "versionType": "git"
            },
            {
              "lessThan": "3767c9f0c1bbd98dd25cb088356a0fc6c1f09f50",
              "status": "affected",
              "version": "117d96a04f007ce8fc2e292369056c3bd09f6f63",
              "versionType": "git"
            },
            {
              "lessThan": "4716a64b7cc2797741f7be4e283ace78a9dff37d",
              "status": "affected",
              "version": "117d96a04f007ce8fc2e292369056c3bd09f6f63",
              "versionType": "git"
            },
            {
              "lessThan": "db9cc9fd9660b2d69ee66f5a4cbec83c21a1c64d",
              "status": "affected",
              "version": "117d96a04f007ce8fc2e292369056c3bd09f6f63",
              "versionType": "git"
            },
            {
              "lessThan": "bbeae12fda3384a90fbebc8a19ba9d33f85b5361",
              "status": "affected",
              "version": "117d96a04f007ce8fc2e292369056c3bd09f6f63",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ceph/osdmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: guard missing CRUSH type name lookup\n\nLocalized read selection can walk a parent bucket whose name exists in\nthe CRUSH map while its type has no matching entry in type_names.\nget_immediate_parent() then dereferences a NULL type_cn and passes an\ninvalid pointer into strcmp(), causing a null-ptr-deref.\n\nSkip such malformed parent buckets unless both the bucket name and type\nname metadata are present. This keeps malformed hierarchy data from\ncrashing locality lookup and safely falls back to \"not local\".\n\n[ idryomov: add WARN_ON_ONCE ]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Malformed CRUSH hierarchy data is delivered to the kernel Ceph client in CEPH_MSG_OSD_MAP over TCP from a monitor or OSD peer, stored in libceph, and later triggers get_immediate_parent() during localized-read target selection on RBD/CephFS client I/O.\nAC:L - A compromised or attacker-controlled Ceph monitor can publish an osdmap whose CRUSH buckets have names but missing type_names entries; once applied, the NULL dereference is reliably hit on subsequent localize-read calc_target() paths without further attacker-controlled timing.\nPR:N - Exploitation requires no privileges on the victim host; any machine acting as a kernel Ceph client that receives a forged osdmap from a cluster peer over the network can be attacked without local capabilities or user-namespace tricks.\nUI:N - No victim user action is needed at exploitation time beyond the host already being a Ceph client with localized reads enabled; forged osdmaps are applied automatically and the crash fires on subsequent kernel client read or map-rescan operations.\nS:U - Impact is confined to kernel memory on the Ceph client host (crash or potential escalation within that host); it does not cross VM, IOMMU, or sandbox boundaries to other security authorities.\nC:N - The failure is a NULL pointer dereference when accessing type_cn-\u003ecn_name; there is no out-of-bounds read, use-after-free, or other memory corruption that could disclose kernel data.\nI:N - The bug causes a NULL pointer dereference crash only; no attacker-controlled write, heap corruption, or control-flow hijack primitive is created by this defect.\nA:H - The NULL pointer dereference in get_immediate_parent() during CRUSH locality lookup causes a kernel oops or panic, denying all service on the affected Ceph client host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:30:27.540Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cbfcba275326c8c7dae9acd8f4a0d4c316fdafb0"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ff579ac03d6e9d17d6d9c8443110167c14a382d"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a4b75d90f0cfbf22c14742ab35a803bc13f36ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/c46d82c47afc968d6ee8ef4470fa2dd35b765c21"
        },
        {
          "url": "https://git.kernel.org/stable/c/3767c9f0c1bbd98dd25cb088356a0fc6c1f09f50"
        },
        {
          "url": "https://git.kernel.org/stable/c/4716a64b7cc2797741f7be4e283ace78a9dff37d"
        },
        {
          "url": "https://git.kernel.org/stable/c/db9cc9fd9660b2d69ee66f5a4cbec83c21a1c64d"
        },
        {
          "url": "https://git.kernel.org/stable/c/bbeae12fda3384a90fbebc8a19ba9d33f85b5361"
        }
      ],
      "title": "libceph: guard missing CRUSH type name lookup",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68157",
    "datePublished": "2026-08-10T11:59:23.692Z",
    "dateReserved": "2026-07-30T09:28:09.371Z",
    "dateUpdated": "2026-08-19T16:30:27.540Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68157",
      "date": "2026-09-11",
      "epss": "0.00686",
      "percentile": "0.50613"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68157\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:01.910\",\"lastModified\":\"2026-08-19T17:20:32.987\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nlibceph: guard missing CRUSH type name lookup\\n\\nLocalized read selection can walk a parent bucket whose name exists in\\nthe CRUSH map while its type has no matching entry in type_names.\\nget_immediate_parent() then dereferences a NULL type_cn and passes an\\ninvalid pointer into strcmp(), causing a null-ptr-deref.\\n\\nSkip such malformed parent buckets unless both the bucket name and type\\nname metadata are present. This keeps malformed hierarchy data from\\ncrashing locality lookup and safely falls back to \\\"not local\\\".\\n\\n[ idryomov: add WARN_ON_ONCE ]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ceph/osdmap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"117d96a04f007ce8fc2e292369056c3bd09f6f63\",\"lessThan\":\"cbfcba275326c8c7dae9acd8f4a0d4c316fdafb0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"117d96a04f007ce8fc2e292369056c3bd09f6f63\",\"lessThan\":\"8ff579ac03d6e9d17d6d9c8443110167c14a382d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"117d96a04f007ce8fc2e292369056c3bd09f6f63\",\"lessThan\":\"6a4b75d90f0cfbf22c14742ab35a803bc13f36ec\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"117d96a04f007ce8fc2e292369056c3bd09f6f63\",\"lessThan\":\"c46d82c47afc968d6ee8ef4470fa2dd35b765c21\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"117d96a04f007ce8fc2e292369056c3bd09f6f63\",\"lessThan\":\"3767c9f0c1bbd98dd25cb088356a0fc6c1f09f50\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"117d96a04f007ce8fc2e292369056c3bd09f6f63\",\"lessThan\":\"4716a64b7cc2797741f7be4e283ace78a9dff37d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"117d96a04f007ce8fc2e292369056c3bd09f6f63\",\"lessThan\":\"db9cc9fd9660b2d69ee66f5a4cbec83c21a1c64d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"117d96a04f007ce8fc2e292369056c3bd09f6f63\",\"lessThan\":\"bbeae12fda3384a90fbebc8a19ba9d33f85b5361\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ceph/osdmap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.265\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.216\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.148\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3767c9f0c1bbd98dd25cb088356a0fc6c1f09f50\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4716a64b7cc2797741f7be4e283ace78a9dff37d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6a4b75d90f0cfbf22c14742ab35a803bc13f36ec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8ff579ac03d6e9d17d6d9c8443110167c14a382d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bbeae12fda3384a90fbebc8a19ba9d33f85b5361\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c46d82c47afc968d6ee8ef4470fa2dd35b765c21\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cbfcba275326c8c7dae9acd8f4a0d4c316fdafb0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/db9cc9fd9660b2d69ee66f5a4cbec83c21a1c64d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-14T22:22:04+00:00",
      "cve": "CVE-2026-68157",
      "id": "CVE-2026-68157",
      "initial_release_date": "2026-08-10T11:59:23.692000+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: libceph null pointer dereference leads to denial of service",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68157.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-09T00:06:50Z",
      "cve": "CVE-2026-68157",
      "id": "CVE-2026-68157",
      "initial_release_date": "2026-08-18T00:08:27Z",
      "product_status:first_fixed": "83",
      "product_status:known_affected": "210",
      "product_status:known_not_affected": "147",
      "product_status:recommended": "11",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68157",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68157.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.