CVE-2026-68160 Overview
CVE-2026-68160 is an out-of-bounds read vulnerability in the Linux kernel's Ceph distributed filesystem client. The flaw resides in the ceph_handle_caps() function, which processes capability messages from a Metadata Server (MDS). A malicious or compromised MDS can craft a ceph_mds_caps message with msg->hdr.version = 1 and an attacker-controlled snap_trace_len value, bypassing all version-gated decoder validation. The kernel then constructs a fake end pointer from the untrusted length, allowing ceph_update_snap_trace() to read past the legitimate msg->front buffer. The vulnerability has existed since ceph_handle_caps() was introduced.
Critical Impact
A malicious Ceph MDS can trigger pre-authentication out-of-bounds reads in the Linux kernel, potentially leading to information disclosure or memory corruption via decoded snap array lengths.
Affected Products
- Linux Kernel (Ceph client filesystem driver)
- Systems mounting CephFS via the in-kernel ceph module
- Distributions shipping vulnerable kernel versions prior to the fix commits
Discovery Timeline
- 2026-08-10 - CVE-2026-68160 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-68160
Vulnerability Analysis
The ceph_handle_caps() function reads snap_trace_len directly from the wire-format ceph_mds_caps header. The kernel uses this length unconditionally to build a synthetic end pointer via snaptrace + snaptrace_len. This pointer is later passed to ceph_update_snap_trace() in the CEPH_CAP_OP_IMPORT case.
The function ceph_update_snap_trace() then decodes a struct ceph_mds_snap_realm using ceph_decode_need(&p, e, sizeof(*ri), bad). With the attacker-supplied end pointer, the bounds check becomes trivially satisfiable. When snap_trace_len == 0xFFFFFFFF, the check passes and ri = p reads sizeof(struct ceph_mds_snap_realm) bytes past the legitimate msg->front buffer.
Subsequent fields ri->num_snaps and ri->num_prior_parent_snaps drive further out-of-bounds reads of the encoded snap arrays. This chains a single length-validation failure into cascading memory disclosure.
Root Cause
The root cause is missing input validation of snap_trace_len against the actual message front buffer size. Version-gated decoder blocks for msg_version >= 2 through msg_version >= 12 correctly validate the length via ceph_decode_*_safe() helpers. However, these decoders sit behind an hdr.version conditional. A malicious MDS setting msg->hdr.version = 1 reaches the CEPH_CAP_OP_IMPORT path without any prior length validation.
Attack Vector
A malicious or compromised Ceph MDS sends a crafted capability message to a client that mounts CephFS. The attacker sets hdr.version = 1 to bypass version-gated decoders and supplies an oversized snap_trace_len such as 0xFFFFFFFF. On 32-bit builds, pointer arithmetic p + snap_trace_len can also overflow the address space, compounding the issue.
The fix validates snap_trace_len using the canonical ceph_decode_need() / ceph_has_room() helper. This helper bounds length via subtraction (n <= end - p, guarded by end >= p), making it wrap-safe for the attacker-controlled u32 length. The vulnerability is described in prose; see the Linux Kernel commit references for the exact patch diffs.
Detection Methods for CVE-2026-68160
Indicators of Compromise
- Unexpected kernel oops, KASAN reports, or crashes originating in ceph_handle_caps() or ceph_update_snap_trace()
- CephFS clients connecting to untrusted or unauthenticated MDS endpoints
- Malformed Ceph MDS caps messages with hdr.version = 1 and abnormally large snap_trace_len fields observed on the wire
Detection Strategies
- Enable KASAN or KFENCE on test kernels to identify out-of-bounds reads triggered by the Ceph client
- Monitor kernel logs for warnings, oopses, or panics referencing ceph_update_snap_trace and ceph_mds_snap_realm decoding
- Inspect network traffic to CephFS MDS endpoints for anomalous message versions or oversized snap trace length fields
Monitoring Recommendations
- Track kernel version inventory across Linux fleets to identify hosts running vulnerable Ceph client code
- Alert on new or unauthorized MDS endpoints appearing in CephFS mount configurations
- Correlate CephFS mount events with kernel crash telemetry to surface exploitation attempts
How to Mitigate CVE-2026-68160
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the stable tree commits and reboot affected systems
- Restrict CephFS clients to trusted, authenticated MDS servers within controlled network segments
- Audit CephFS mount points across the environment and remove connections to untrusted clusters
Patch Information
The fix is applied across multiple stable branches. Relevant commits include 03b417afce19, 4dbc71bcaf9a, 71893c342a26, 9081c71796724, and a4228b937066. See the Linux Kernel Commit Log and the additional stable tree references for the complete patch set. The patch adds a ceph_decode_need() bound check against the message front buffer before consuming snap_trace_len.
Workarounds
- Unmount CephFS filesystems on hosts that cannot be patched immediately
- Enforce network-level segmentation between CephFS clients and any untrusted MDS instance
- Use CephX authentication with strong keyrings to reduce the risk of a rogue MDS entering the trust boundary
# Verify kernel version and unmount CephFS where patching is deferred
uname -r
mount | grep ceph
umount -a -t ceph
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
