CVE-2026-68159: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-68159 Overview

CVE-2026-68159 is a stack out-of-bounds write vulnerability in the Linux kernel's libceph subsystem. The flaw resides in __decode_pg_temp() and __decode_pg_upmap_items(), which decode user-controlled length fields from an OSDMap without bounding the value to CEPH_PG_MAX_SIZE. A malicious Ceph monitor can send an OSDMap containing a pg_temp or pg_upmap entry longer than 32 entries. The decoded list is later copied into the fixed-size on-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE], producing a stack out-of-bounds write detected by KASAN. The condition triggers during Ceph RBD device probing and OSD request submission.

Critical Impact
A malicious or compromised Ceph monitor can trigger a kernel stack out-of-bounds write on connected Linux clients, enabling denial of service and potentially kernel memory corruption leading to code execution.

Affected Products

Linux kernel libceph subsystem (net/ceph/osdmap.c)
Linux kernel Ceph RBD block driver (drivers/block/rbd.c)
Linux distributions shipping affected kernel versions with Ceph client support

Discovery Timeline

2026-08-10 - CVE-2026-68159 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68159

Vulnerability Analysis

The vulnerability originates in the Ceph OSDMap decoding path. The helper __decode_pg_temp() reads a length value directly from the wire-format OSDMap message. The prior validation only rejected values large enough to overflow the allocation size calculation, leaving a wide window of oversized but non-overflowing values accepted as valid.

The same helper backs both pg_temp and pg_upmap decoding. Downstream, apply_upmap() and get_temp_osds() copy the decoded OSD list into a fixed-size on-stack array declared as struct ceph_osds.osds[CEPH_PG_MAX_SIZE], where CEPH_PG_MAX_SIZE is 32. Any decoded length greater than 32 causes writes beyond the array bounds, corrupting adjacent stack frames.

KASAN captures the condition as a stack-out-of-bounds write in ceph_pg_to_up_acting_osds during a call chain originating from rbd_dev_image_probe() and ceph_osdc_start_request(). The crash surfaces as kernel BUG at net/ceph/osdmap.c:2670.

Root Cause

The root cause is missing input validation [CWE-20] on an attacker-controlled length field decoded from an untrusted monitor message. The decoder validated only against integer overflow in the allocation path, not against the semantic maximum defined by CEPH_PG_MAX_SIZE. An OSD set for a single placement group cannot exceed that constant, so any larger value is inherently malformed.

Attack Vector

A Ceph monitor sends a crafted OSDMap containing a pg_temp, pg_upmap, or pg_upmap_items entry whose OSD list length exceeds 32. When a Linux client processes the map, the decoded list is copied into the on-stack ceph_osds.osds array, writing past its bounds. The attack requires a monitor peer able to deliver an OSDMap to the client, such as a compromised or malicious Ceph cluster peer reachable over the network.

The vulnerability mechanism is described in the upstream commits. See the Kernel Git Commit 9f00f9c and Kernel Git Commit e366631 for the applied bounds check.

Detection Methods for CVE-2026-68159

Indicators of Compromise

Kernel panic or oops with the signature kernel BUG at net/ceph/osdmap.c:2670 on Ceph client hosts.
KASAN reports referencing stack-out-of-bounds in ceph_pg_to_up_acting_osds, calc_target, or __submit_request.
Unexpected crashes of processes performing rbd map or other RBD operations against untrusted Ceph clusters.

Detection Strategies

Monitor kernel ring buffer (dmesg) and journalctl -k for BUG or KASAN entries pointing to net/ceph/osdmap.c.
Inventory hosts running kernels with libceph loaded and identify which connect to external or multi-tenant Ceph clusters.
Alert on repeated crash-restart cycles of Ceph clients or RBD-backed workloads, which may indicate exploitation attempts.

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and build detections for Ceph OSDMap decoding faults.
Track kernel version compliance across the fleet to confirm patched builds are deployed.
Restrict which monitor endpoints Ceph clients trust and log new or unexpected monitor peers.

How to Mitigate CVE-2026-68159

Immediate Actions Required

Update the Linux kernel to a version containing commits 9f00f9cf2be2 and e36663145abd, which enforce the CEPH_PG_MAX_SIZE bound at decode time.
Restrict Ceph client hosts to trusted monitor endpoints and isolate them from untrusted networks.
Unload the ceph and rbd kernel modules on systems that do not require Ceph client functionality.

Patch Information

The fix rejects any pg_temp, pg_upmap, or pg_upmap_items entry with a length greater than CEPH_PG_MAX_SIZE (32) during decoding. The same check was added to __decode_pg_upmap_items(). The bound is well below the previous overflow threshold, so it also covers the allocation-size overflow the earlier check guarded against. Apply the vendor kernel update from your Linux distribution that incorporates the referenced upstream commits.

Workarounds

Disable or unload the ceph and rbd kernel modules on hosts that do not consume Ceph storage.
Enforce network segmentation so that only vetted, trusted Ceph monitors can reach client hosts on Ceph ports.
Where possible, migrate to userspace Ceph clients whose crash surface is contained outside the kernel until patches are applied.

bash

# Verify kernel commits present in running kernel and unload modules if unused
uname -r
lsmod | grep -E 'ceph|rbd'
sudo modprobe -r rbd ceph libceph 2>/dev/null || true