CVE-2026-68154: Linux Kernel CRUSH Decode Vulnerability

CVE-2026-68154 Overview

CVE-2026-68154 is a Linux kernel vulnerability in the libceph subsystem. The flaw resides in the crush_decode() function, which fails to reject CRUSH bucket type 0 during map decoding. CRUSH bucket type 0 is reserved exclusively for devices, and the mapper uses this invariant to identify leaf devices. A malformed CRUSH map that violates this invariant can cause the mapper to treat a negative bucket ID as a device and pass it to is_out(), which then indexes the OSD weight array using a negative value. The resulting out-of-bounds access affects any Linux system using the Ceph client kernel module.

Critical Impact
A malformed CRUSH map delivered to a Ceph client can trigger negative-index array access in the kernel, leading to memory corruption or denial of service.

Affected Products

Linux kernel libceph module (upstream)
Linux distributions shipping the affected kernel branches
Systems mounting Ceph storage (CephFS or RBD) via the in-kernel client

Discovery Timeline

2026-08-10 - CVE-2026-68154 published to the National Vulnerability Database (NVD)
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68154

Vulnerability Analysis

The vulnerability originates in the CRUSH (Controlled Replication Under Scalable Hashing) map decoder used by the Linux kernel Ceph client. CRUSH is the algorithm Ceph uses to compute data placement across an object storage cluster. Bucket types in CRUSH represent hierarchy levels such as hosts, racks, and rows, with type 0 reserved to indicate devices (leaf nodes).

The crush_decode() function accepts bucket metadata from server-supplied CRUSH maps without validating that non-leaf buckets declare a non-zero type. When a bucket carries type 0, downstream mapper logic misinterprets its identifier. The mapper propagates a negative bucket ID into is_out(), which uses that value to index the OSD weight array. Negative array indexing in kernel context produces out-of-bounds memory reads and can destabilize the system.

Root Cause

The root cause is missing input validation on untrusted CRUSH map data. The decoder violated the reserved-type invariant that the mapper depends on, resulting in a state where negative bucket identifiers were treated as valid device indices. This is an input validation error [CWE-20] leading to an out-of-bounds read.

Attack Vector

The attack vector is network-based. Any component that supplies CRUSH maps to a kernel Ceph client — including a compromised Ceph monitor, a rogue server on the storage network, or a man-in-the-middle position on unauthenticated Ceph traffic — can deliver a crafted map with a zero-typed non-leaf bucket. Because the kernel client parses the map before the mapper enforces higher-level checks, exploitation requires no interaction on the client host.

The vulnerability manifests during CRUSH map decoding when a bucket
declares type 0 outside its reserved device role. See the upstream fix
at git.kernel.org for the exact validation logic added to crush_decode().

Detection Methods for CVE-2026-68154

Indicators of Compromise

Kernel oops, panic, or KASAN reports referencing crush_decode, is_out, or the OSD weight array
Unexpected termination of Ceph mount operations after receiving updated OSD maps
Ceph monitor traffic originating from unauthorized peers on storage VLANs

Detection Strategies

Monitor kernel logs (dmesg, journalctl -k) for stack traces containing libceph or crush_ symbols
Compare running kernel versions against distribution advisories referencing the upstream commits listed in the kernel.org stable tree
Inspect Ceph cluster audit logs for CRUSH map updates from unexpected sources or with unusual bucket structures

Monitoring Recommendations

Centralize kernel telemetry from all Ceph client nodes and alert on repeated libceph faults
Track patch level and kernel build hashes across the fleet to identify unpatched hosts
Enforce cephx authentication and TLS on the Ceph messenger to reduce exposure to malformed maps from off-cluster sources

How to Mitigate CVE-2026-68154

Immediate Actions Required

Apply the vendor-supplied kernel update that incorporates the upstream libceph fix rejecting zero bucket types in crush_decode()
Inventory all systems running the in-kernel Ceph client, including CephFS mounts and RBD-mapped block devices
Restrict Ceph messenger traffic to trusted monitor and OSD endpoints using host and network firewalls

Patch Information

The fix adds validation in crush_decode() to reject buckets that declare type 0, preventing the invalid state from reaching the mapper. Upstream commits are available at the kernel.org stable tree, with additional backports referenced in commits 05f9028, 3b2f193, 70998f9, and b8a9fb6. Consult your Linux distribution for backported kernel packages.

Workarounds

Unmount CephFS and unmap RBD volumes on hosts that cannot be patched immediately, and use userspace Ceph clients where feasible
Segregate storage traffic on isolated networks so only authenticated Ceph monitors and OSDs can deliver CRUSH maps to clients
Enforce cephx authentication and messenger v2 with ms_client_mode=secure to authenticate and encrypt map delivery

bash

# Verify running kernel and identify Ceph client usage
uname -r
lsmod | grep -E 'ceph|rbd'
mount -t ceph
rbd showmapped

# Enforce authenticated, encrypted Ceph messaging
ceph config set global ms_client_mode secure
ceph config set global auth_client_required cephx