CVE-2026-68154

libceph: reject zero bucket types in crush_decode

State: Published
Severity: 9.8 Critical
Published: Aug 10, 2026
Updated: Oct 19, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

libceph: reject zero bucket types in crush_decode

CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices.

If crush_decode() accepts a bucket with type 0, a malformed CRUSH map can make the mapper treat a negative bucket ID as a device and pass it to is_out(), which then indexes the OSD weight array with a negative value.

Reject zero bucket types while decoding the CRUSH map so the invalid state never reaches the mapper.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
LinuxLinux	f24e9980eb860d8600cbe5ef3d2fd9295320d229 to before 952ca5dc99913d169263f59fd689f586729a13c1Affected f24e9980eb860d8600cbe5ef3d2fd9295320d229 to before 146461f09565afe3665e65b0423d3d6b0fe806c5Affected f24e9980eb860d8600cbe5ef3d2fd9295320d229 to before 80fc40e11cda1b5d990a3f69c6efa344fb5cd987Affected f24e9980eb860d8600cbe5ef3d2fd9295320d229 to before b8a9fb6bf806f9c4891e71ae1beab0c07c23a877Affected f24e9980eb860d8600cbe5ef3d2fd9295320d229 to before 826cd1de5802fd392922785f9b64d76e65d2a100Affected f24e9980eb860d8600cbe5ef3d2fd9295320d229 to before 3b2f1937f5fce8b7dd5432e7693e3cc8b5eece56Affected f24e9980eb860d8600cbe5ef3d2fd9295320d229 to before 70998f91030ee083ecb336a1dff0701c20a38081Affected f24e9980eb860d8600cbe5ef3d2fd9295320d229 to before 05f90284223381005d6bcddab3fda4a97f9c3401Affected
LinuxLinux	2.6.34Affected before 2.6.34Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

f24e9980eb860d8600cbe5ef3d2fd9295320d229 to before 952ca5dc99913d169263f59fd689f586729a13c1Affected
f24e9980eb860d8600cbe5ef3d2fd9295320d229 to before 146461f09565afe3665e65b0423d3d6b0fe806c5Affected
f24e9980eb860d8600cbe5ef3d2fd9295320d229 to before 80fc40e11cda1b5d990a3f69c6efa344fb5cd987Affected
f24e9980eb860d8600cbe5ef3d2fd9295320d229 to before b8a9fb6bf806f9c4891e71ae1beab0c07c23a877Affected
f24e9980eb860d8600cbe5ef3d2fd9295320d229 to before 826cd1de5802fd392922785f9b64d76e65d2a100Affected
f24e9980eb860d8600cbe5ef3d2fd9295320d229 to before 3b2f1937f5fce8b7dd5432e7693e3cc8b5eece56Affected
f24e9980eb860d8600cbe5ef3d2fd9295320d229 to before 70998f91030ee083ecb336a1dff0701c20a38081Affected
f24e9980eb860d8600cbe5ef3d2fd9295320d229 to before 05f90284223381005d6bcddab3fda4a97f9c3401Affected

LinuxLinux

2.6.34Affected
before 2.6.34Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.