CVE-2026-68157: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-68157 Overview

CVE-2026-68157 is a null pointer dereference vulnerability in the Linux kernel's libceph component. The flaw resides in the CRUSH (Controlled Replication Under Scalable Hashing) map handling code used for localized read selection. When get_immediate_parent() walks a parent bucket whose name exists in the CRUSH map but whose type has no matching entry in type_names, it dereferences a NULL type_cn pointer and passes an invalid pointer into strcmp(). This triggers a null-ptr-deref condition that crashes the locality lookup path.

Critical Impact
Malformed CRUSH hierarchy metadata can trigger a kernel null pointer dereference, leading to denial of service on Ceph client systems.

Affected Products

Linux kernel libceph subsystem
Systems mounting CephFS or using RBD (RADOS Block Device) clients
Distributions shipping vulnerable Linux kernel versions prior to the fix commits

Discovery Timeline

2026-08-10 - CVE-2026-68157 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68157

Vulnerability Analysis

The vulnerability affects the Ceph client kernel module during localized read operations. The Ceph client uses the CRUSH algorithm to map objects to Object Storage Daemons (OSDs). Localized read selection requires walking the parent bucket hierarchy to determine whether an OSD is topologically "local" to the requesting client.

During this traversal, get_immediate_parent() looks up the type name associated with each parent bucket. The code assumes both the bucket name and its corresponding type name exist in the CRUSH map metadata. When the map contains a bucket with a valid name but no matching entry in the type_names table, type_cn remains NULL. The function then passes this NULL pointer to strcmp(), producing a null pointer dereference in kernel context.

Root Cause

The root cause is missing validation of CRUSH map metadata consistency. The libceph code trusts that any bucket name resolvable in the CRUSH map has a corresponding type name entry. Malformed or inconsistent CRUSH maps break this invariant, and the absence of a NULL check before the strcmp() call converts the metadata inconsistency into a kernel crash.

Attack Vector

An attacker able to influence CRUSH map contents delivered to Ceph clients can trigger the crash remotely over the network. The vulnerability requires no authentication or user interaction at the client level. Successful exploitation causes the kernel path handling locality lookup to dereference NULL, producing a denial of service on the affected client host.

The fix, applied across the referenced kernel git commits, skips malformed parent buckets unless both the bucket name and type name metadata are present. The patch also adds a WARN_ON_ONCE to surface the malformed condition, and safely falls back to treating the OSD as "not local" rather than crashing.

Detection Methods for CVE-2026-68157

Indicators of Compromise

Kernel oops or panic messages referencing get_immediate_parent or libceph in dmesg output
WARN_ON_ONCE entries in kernel logs originating from CRUSH map processing after applying the patch
Unexpected reboots or hangs on Ceph client nodes coinciding with map updates from monitors

Detection Strategies

Monitor kernel ring buffer and journalctl -k output for null pointer dereference traces inside libceph symbols
Correlate Ceph monitor CRUSH map updates with client-side crash events to identify malformed map propagation
Track kernel versions across the fleet and flag hosts running unpatched libceph while connected to Ceph clusters

Monitoring Recommendations

Ingest kernel logs from all Ceph client hosts into a centralized log platform for pattern analysis
Alert on repeated crashes of the same client process paths interacting with /dev/rbd* or CephFS mounts
Audit CRUSH map integrity on Ceph monitors and validate that every bucket type referenced has a corresponding type_names entry

How to Mitigate CVE-2026-68157

Immediate Actions Required

Inventory all Linux hosts running Ceph client code, including RBD and CephFS consumers
Apply vendor kernel updates that incorporate the upstream fix commits referenced in the NVD entry
Validate CRUSH map integrity on Ceph monitors and remove or repair buckets missing type name metadata

Patch Information

The fix is available in the upstream Linux kernel through the commits 3767c9f0c1bb, 4716a64b7cc2, bbeae12fda33, c46d82c47afc, and db9cc9fd9660. The patch introduces a guard that skips parent buckets lacking both name and type name metadata and adds a WARN_ON_ONCE to record the malformed state. Distribution kernels should be updated to versions incorporating these commits.

Workarounds

Restrict CRUSH map modification privileges on Ceph monitors to trusted administrators only
Validate CRUSH maps in a staging cluster before promoting to production to catch missing type_names entries
Where kernel updates cannot be applied immediately, isolate Ceph client hosts from untrusted monitor traffic using network segmentation

bash

# Verify running kernel version and Ceph client status
uname -r
modinfo libceph | grep -E '^(version|filename):'

# Inspect kernel logs for libceph null dereference traces
dmesg -T | grep -i -E 'libceph|get_immediate_parent|null'

# Validate CRUSH map type_names consistency on a Ceph monitor
ceph osd getcrushmap -o /tmp/crush.map
crushtool -d /tmp/crush.map -o /tmp/crush.txt
grep -E '^(type|host|rack|root)' /tmp/crush.txt