CVE-2026-68158: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-68158 Overview

CVE-2026-68158 is a multiplication overflow vulnerability in the Linux kernel's libceph subsystem. The flaw resides in the decode_new_up_state_weight() function, which processes CEPH_MSG_OSD_MAP messages. A maliciously corrupted osdmap can trigger a length calculation overflow, defeating the bounds check that protects subsequent memory access. This leads to out-of-bounds reads when decoding the new_state portion of the message. The vulnerability is network-reachable and requires no authentication or user interaction, placing kernel memory integrity at risk on any host running the Ceph client.

Critical Impact
A crafted OSD map message can cause out-of-bounds kernel memory reads in libceph, potentially exposing sensitive kernel data or destabilizing systems that mount Ceph storage.

Affected Products

Linux kernel libceph subsystem (multiple stable branches referenced in upstream fixes)
Systems using the in-kernel Ceph client (RBD, CephFS)
Distributions shipping vulnerable kernels prior to the referenced stable commits

Discovery Timeline

2026-08-10 - CVE-2026-68158 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68158

Vulnerability Analysis

The libceph client parses OSD map updates delivered via CEPH_MSG_OSD_MAP messages. Within decode_new_up_state_weight(), the decoder reads a len value from the incoming message and multiplies it by the size of each new_state item to compute the expected buffer span. The result feeds the bounds check that gates further decoding.

When an attacker supplies a large len, the multiplication wraps around, producing an artificially small value. The bounds check passes even though the decoder will read well beyond the message buffer. Subsequent iterations perform out-of-bounds reads inside kernel address space [CWE-190, CWE-125].

The upstream fix replaces the arithmetic with check_mul_overflow(), aborting osdmap processing when overflow occurs. The patch also renames new_state_len to new_state_item_size for clarity.

Root Cause

The root cause is an unchecked integer multiplication used to compute a size boundary from attacker-controlled input. Without overflow detection, the calculated length wraps, and the length-based sanity check no longer reflects the true memory footprint the decoder will traverse.

Attack Vector

An attacker capable of injecting or influencing OSD map messages delivered to a Ceph client can trigger the flaw. This includes a compromised or malicious Ceph monitor, a network attacker in a position to intercept and modify Ceph traffic, or any actor able to feed crafted messages to a vulnerable kernel client. No authentication or user interaction is required beyond the client accepting an OSD map update.

// No verified public exploit code is available for CVE-2026-68158.
// See upstream commits for the corrected bounds-check logic:
//   https://git.kernel.org/stable/c/143ba49ead77ec483c0326f8aaad8649874e99c4
//   https://git.kernel.org/stable/c/1732d89dfcd74f6fde9ce70900d316c4a151c153

Detection Methods for CVE-2026-68158

Indicators of Compromise

Kernel warnings, KASAN reports, or oopses referencing decode_new_up_state_weight or libceph in dmesg and journal logs
Unexpected Ceph client disconnects or reconnects following receipt of an OSD map update
Malformed CEPH_MSG_OSD_MAP messages observed on port 6789/tcp (monitor) or OSD ports

Detection Strategies

Inventory hosts running vulnerable kernel versions using package manager queries and compare against fixed stable releases listed in the referenced git commits
Monitor kernel logs for libceph decoder faults and correlate with Ceph monitor session activity
Inspect Ceph monitor and OSD network traffic for anomalous OSD map sizes or unexpected sources

Monitoring Recommendations

Forward kernel logs from Ceph clients to a centralized logging platform and alert on libceph error patterns
Track Ceph monitor authentication events to detect rogue monitors attempting to push crafted maps
Baseline OSD map message sizes and alert on outliers that could indicate crafted len values

How to Mitigate CVE-2026-68158

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 143ba49, 1732d89, 05c90e0, 98917a4, and bee4b5b, or upgrade to a distribution kernel that includes them
Restrict Ceph client network exposure so that only trusted monitors and OSDs can deliver messages
Enforce cephx authentication on all Ceph clusters and rotate keys if a compromise is suspected

Patch Information

The fix is available in the mainline Linux kernel and multiple stable branches. Relevant upstream references include Kernel Git Commit 143ba49, Kernel Git Commit 1732d89, Kernel Git Commit 05c90e0, Kernel Git Commit 98917a4, and Kernel Git Commit bee4b5b. The corrected code path uses check_mul_overflow() to reject osdmaps whose length calculations overflow.

Workarounds

Unmount CephFS and unmap RBD devices on hosts that cannot be patched immediately
Isolate Ceph client traffic on a dedicated, access-controlled network segment
Blacklist the ceph and rbd kernel modules on systems that do not require Ceph connectivity

bash

# Confirm the currently running kernel and Ceph module status
uname -r
lsmod | grep -E '^(ceph|rbd|libceph)'

# Temporarily disable Ceph kernel clients on unpatched hosts
umount -a -t ceph
rbd unmap --all
modprobe -r rbd ceph libceph

# Prevent auto-load until the kernel is patched
cat <<'EOF' >/etc/modprobe.d/blacklist-ceph.conf
blacklist ceph
blacklist rbd
blacklist libceph
EOF