CVE-2026-68155

libceph: Reject monmaps advertising zero monitors

State: Published
Severity: 7.5 High
Published: Aug 10, 2026
Updated: Oct 19, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

libceph: Reject monmaps advertising zero monitors

A message of type CEPH_MSG_MON_MAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the existing monitors in the cluster. Currently, a monmap indicating that there are zero monitors in the cluster is treated as valid. However, it is impossible to have zero monitors in the cluster and still receive a valid monmap from a monitor. Therefore, such a monmap must be corrupted and should be treated as invalid. Furthermore, a monmap with a monitor count of zero can subsequently crash the client when attempting to open a session with a monitor in __open_session(). This happens because the "BUG_ON(monc->monmap->num_mon < 1)" assertion in pick_new_mon() is triggered.

This patch extends a check in ceph_monmap_decode() to also reject arriving mon_maps with num_mon == 0 rather than only with num_mon > CEPH_MAX_MON.

[ idryomov: drop "log output for unusual values of num_mon" part ]

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
LinuxLinux	ba75bb98cfb93b62c54af25bf67ff90857264bbe to before ba5f0015bfd376d764163045a61c17be75f44daeAffected ba75bb98cfb93b62c54af25bf67ff90857264bbe to before caf082ef8609a6ac26159ce115f55ab7d00231a3Affected ba75bb98cfb93b62c54af25bf67ff90857264bbe to before e3ccd4ecab09b22f507f49cb7ed9990c7158ceabAffected ba75bb98cfb93b62c54af25bf67ff90857264bbe to before 0591a15815b498be628a937146e44487d599ba33Affected ba75bb98cfb93b62c54af25bf67ff90857264bbe to before cd0d41bc569632eaaeccde9d2a6bc919ec00c407Affected ba75bb98cfb93b62c54af25bf67ff90857264bbe to before e67e8b694872c9bc66996040f9de9242f6236ed9Affected ba75bb98cfb93b62c54af25bf67ff90857264bbe to before 3b249546f59c3d6d3592c10657f82bc3f1faa07cAffected ba75bb98cfb93b62c54af25bf67ff90857264bbe to before 40480eee361ed9676b3f844d532ac28b47251634Affected
LinuxLinux	2.6.34Affected before 2.6.34Not affected 5.10.271 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

ba75bb98cfb93b62c54af25bf67ff90857264bbe to before ba5f0015bfd376d764163045a61c17be75f44daeAffected
ba75bb98cfb93b62c54af25bf67ff90857264bbe to before caf082ef8609a6ac26159ce115f55ab7d00231a3Affected
ba75bb98cfb93b62c54af25bf67ff90857264bbe to before e3ccd4ecab09b22f507f49cb7ed9990c7158ceabAffected
ba75bb98cfb93b62c54af25bf67ff90857264bbe to before 0591a15815b498be628a937146e44487d599ba33Affected
ba75bb98cfb93b62c54af25bf67ff90857264bbe to before cd0d41bc569632eaaeccde9d2a6bc919ec00c407Affected
ba75bb98cfb93b62c54af25bf67ff90857264bbe to before e67e8b694872c9bc66996040f9de9242f6236ed9Affected
ba75bb98cfb93b62c54af25bf67ff90857264bbe to before 3b249546f59c3d6d3592c10657f82bc3f1faa07cAffected
ba75bb98cfb93b62c54af25bf67ff90857264bbe to before 40480eee361ed9676b3f844d532ac28b47251634Affected

LinuxLinux

2.6.34Affected
before 2.6.34Not affected
5.10.271 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.