CVE-2026-68155: Linux Kernel DOS Vulnerability

CVE-2026-68155 Overview

CVE-2026-68155 is a denial of service vulnerability in the Linux kernel's libceph subsystem. The flaw lets a malicious or compromised Ceph monitor deliver a CEPH_MSG_MON_MAP message containing a monmap that advertises zero monitors. The client accepts this corrupted monmap as valid, then triggers the BUG_ON(monc->monmap->num_mon < 1) assertion inside pick_new_mon() when __open_session() attempts to open a session. The result is a kernel panic on the client machine, disrupting any workload that mounts a CephFS filesystem or uses RBD block devices backed by the affected client.

Critical Impact
A remote attacker controlling monitor traffic can crash any Linux client using libceph by sending a monmap with num_mon == 0.

Affected Products

Linux kernel libceph module across multiple stable branches
CephFS clients relying on the in-kernel Ceph implementation
RBD (Rados Block Device) clients on affected kernel versions

Discovery Timeline

2026-08-10 - CVE-2026-68155 published to the National Vulnerability Database
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68155

Vulnerability Analysis

The libceph kernel component maintains cluster membership through monmaps advertised by Ceph monitors. When a client receives a CEPH_MSG_MON_MAP message, the ceph_monmap_decode() function validates the payload before caching it. The existing validation only rejected monmaps where num_mon > CEPH_MAX_MON, leaving the lower bound unchecked. A monmap with num_mon == 0 therefore passed validation despite being semantically impossible, since a running cluster cannot deliver a valid monmap while claiming to have no monitors.

After the malformed monmap was cached, the client eventually invoked __open_session() to establish a monitor session. That path calls pick_new_mon(), which asserts BUG_ON(monc->monmap->num_mon < 1). Hitting the BUG_ON triggers a kernel oops and, depending on configuration, a full panic. This produces reliable client-side denial of service from a single malformed message.

Root Cause

The root cause is missing lower-bound input validation in ceph_monmap_decode(). The function trusted that the sender would never advertise zero monitors and only guarded against oversized monitor counts. This is a classic improper input validation flaw that violates the invariant pick_new_mon() later relies upon.

Attack Vector

Exploitation requires the attacker to deliver a crafted CEPH_MSG_MON_MAP to a client. This is feasible for an attacker who compromises a monitor node, sits on an unauthenticated or misconfigured Ceph network path, or otherwise injects traffic on the storage plane. No user interaction and no authentication are required on the victim client itself. The impact is limited to availability: the client kernel crashes, but confidentiality and integrity of stored data are not directly affected.

No verified public proof-of-concept code is available. See the upstream fix commits in the kernel.org stable tree for the exact decoder change.

Detection Methods for CVE-2026-68155

Indicators of Compromise

Kernel oops or panic messages referencing pick_new_mon, __open_session, or the BUG_ON(monc->monmap->num_mon < 1) assertion in libceph.
Unexpected reboots or hung CephFS/RBD mounts on Linux clients coinciding with monitor traffic.
dmesg entries showing libceph session establishment failures immediately before a crash.

Detection Strategies

Ingest kernel logs from Ceph clients into a centralized logging pipeline and alert on BUG_ON traces originating from net/ceph/.
Monitor Ceph monitor egress for anomalous CEPH_MSG_MON_MAP messages, especially from unexpected source IPs on the public monitor network.
Correlate client kernel panics with monitor topology changes to identify potentially malicious monmap propagation.

Monitoring Recommendations

Track kernel version inventory across all hosts running CephFS or RBD workloads and flag hosts still on unpatched libceph.
Alert on repeated client reconnection loops to Ceph monitors, which may indicate crash-restart cycles.
Baseline expected monitor peers using ceph mon dump and flag clients that receive monmaps referencing unknown quorum members.

How to Mitigate CVE-2026-68155

Immediate Actions Required

Apply the latest stable Linux kernel updates that include the libceph monmap validation fix from your distribution vendor.
Restrict network access to Ceph monitor ports (tcp/3300 and tcp/6789) so only authorized cluster nodes can reach clients on the monitor plane.
Enable cephx authentication cluster-wide to make monitor impersonation substantially harder.

Patch Information

Upstream fixes are available in the mainline and stable trees. Reference commits: 0591a15, 3b24954, 40480ee, cd0d41b, and e67e8b6. The patch extends the existing check in ceph_monmap_decode() to reject monmaps with num_mon == 0 in addition to the previous upper bound.

Workarounds

Segment the Ceph public network with firewall rules that permit monitor-to-client traffic only from known-good monitor IP addresses.
Where feasible, unmount CephFS and detach RBD devices on hosts that cannot be patched immediately to remove the vulnerable code path.
Enforce cephx authentication and use dedicated management VLANs to reduce the ability of an attacker to inject monitor messages.

bash

# Verify running kernel and confirm libceph fix is present
uname -r
# Check distribution package status for the kernel update
apt list --installed 2>/dev/null | grep linux-image   # Debian/Ubuntu
rpm -qa | grep kernel                                 # RHEL/Fedora/SUSE

# Restrict monitor plane at the host firewall (example: nftables)
nft add rule inet filter input ip saddr != { 10.0.0.10, 10.0.0.11, 10.0.0.12 } \
    tcp dport { 3300, 6789 } drop