{"id":"CVE-2026-68154","revision":"8a48fb625f224521947e8b29bc9a8fe0","records":[{"revision":"8a48fb625f224521947e8b29bc9a8fe0","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-68154","aliases":[],"title":"libceph: reject zero bucket types in crush_decode","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: reject zero bucket types in crush_decode\n\nCRUSH bucket type 0 is reserved for devices.  The mapper relies on\nthat invariant and uses type 0 to identify leaf devices.\n\nIf crush_decode() accepts a bucket with type 0, a malformed CRUSH map\ncan make the mapper treat a negative bucket ID as a device and pass it\nto is_out(), which then indexes the OSD weight array with a negative\nvalue.\n\nReject zero bucket types while decoding the CRUSH map so the invalid\nstate never reaches the mapper.","state":0,"publishedAt":"2026-08-10T11:59:20.25+00:00","modifiedAt":"2026-10-19T20:58:54.485+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ceph/osdmap.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"f24e9980eb860d8600cbe5ef3d2fd9295320d229\",\n                            \"lessThan\": \"952ca5dc99913d169263f59fd689f586729a13c1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f24e9980eb860d8600cbe5ef3d2fd9295320d229\",\n                            \"lessThan\": \"146461f09565afe3665e65b0423d3d6b0fe806c5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f24e9980eb860d8600cbe5ef3d2fd9295320d229\",\n                            \"lessThan\": \"80fc40e11cda1b5d990a3f69c6efa344fb5cd987\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f24e9980eb860d8600cbe5ef3d2fd9295320d229\",\n                            \"lessThan\": \"b8a9fb6bf806f9c4891e71ae1beab0c07c23a877\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f24e9980eb860d8600cbe5ef3d2fd9295320d229\",\n                            \"lessThan\": \"826cd1de5802fd392922785f9b64d76e65d2a100\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f24e9980eb860d8600cbe5ef3d2fd9295320d229\",\n                            \"lessThan\": \"3b2f1937f5fce8b7dd5432e7693e3cc8b5eece56\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f24e9980eb860d8600cbe5ef3d2fd9295320d229\",\n                            \"lessThan\": \"70998f91030ee083ecb336a1dff0701c20a38081\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f24e9980eb860d8600cbe5ef3d2fd9295320d229\",\n                            \"lessThan\": \"05f90284223381005d6bcddab3fda4a97f9c3401\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ceph/osdmap.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.34\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.34\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.265\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.216\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.183\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.148\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.101\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.42\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.6\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/952ca5dc99913d169263f59fd689f586729a13c1","https://git.kernel.org/stable/c/146461f09565afe3665e65b0423d3d6b0fe806c5","https://git.kernel.org/stable/c/80fc40e11cda1b5d990a3f69c6efa344fb5cd987","https://git.kernel.org/stable/c/b8a9fb6bf806f9c4891e71ae1beab0c07c23a877","https://git.kernel.org/stable/c/826cd1de5802fd392922785f9b64d76e65d2a100","https://git.kernel.org/stable/c/3b2f1937f5fce8b7dd5432e7693e3cc8b5eece56","https://git.kernel.org/stable/c/70998f91030ee083ecb336a1dff0701c20a38081","https://git.kernel.org/stable/c/05f90284223381005d6bcddab3fda4a97f9c3401"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68154","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-68154","identifiers":["CVE-2026-68154"]},"retained":false,"historicalAffected":[]}],"coverage":[]}