Answer in brief
CVE-2026-68155 records a Unknown severity vulnerability in libceph: Reject monmaps advertising zero monitors. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <0591a15815b498be628a937146e44487d599ba33 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <cd0d41bc569632eaaeccde9d2a6bc919ec00c407 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <e67e8b694872c9bc66996040f9de9242f6236ed9 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <3b249546f59c3d6d3592c10657f82bc3f1faa07c || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <40480eee361ed9676b3f844d532ac28b47251634 || >=0 <6.6.148 || >=0 <6.12.101 || >=0 <6.18.42 || >=0 <7.1.6 | 0591a15815b498be628a937146e44487d599ba33, cd0d41bc569632eaaeccde9d2a6bc919ec00c407, e67e8b694872c9bc66996040f9de9242f6236ed9, 3b249546f59c3d6d3592c10657f82bc3f1faa07c, 40480eee361ed9676b3f844d532ac28b47251634, 6.6.148, 6.12.101, 6.18.42, 7.1.6 |
Published upstream
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 10, 2026
In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPH_MSG_MON_MAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the existing monitors in the cluster. Currently, a monmap indicating that there are zero monitors in the cluster is treated as valid. However, it is impossible to have zero monitors in the cluster and still receive a valid monmap from a monitor. Therefore, such a monmap must be corrupted and should be treated as invalid. Furthermore, a monmap with a monitor count of zero can subsequently crash the client when attempting to open a session with a monitor in __open_session(). This happens because the "BUG_ON(monc->monmap->num_mon < 1)" assertion in pick_new_mon() is triggered. This patch extends a check in ceph_monmap_decode() to also reject arriving mon_maps with num_mon == 0 rather than only with num_mon > CEPH_MAX_MON. [ idryomov: drop "log output for unusual values of num_mon" part ]
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-68155 records a Unknown severity vulnerability in libceph: Reject monmaps advertising zero monitors. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <0591a15815b498be628a937146e44487d599ba33 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <cd0d41bc569632eaaeccde9d2a6bc919ec00c407 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <e67e8b694872c9bc66996040f9de9242f6236ed9 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <3b249546f59c3d6d3592c10657f82bc3f1faa07c || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <40480eee361ed9676b3f844d532ac28b47251634 || >=0 <6.6.148 || >=0 <6.12.101 || >=0 <6.18.42 || >=0 <7.1.6 | 0591a15815b498be628a937146e44487d599ba33, cd0d41bc569632eaaeccde9d2a6bc919ec00c407, e67e8b694872c9bc66996040f9de9242f6236ed9, 3b249546f59c3d6d3592c10657f82bc3f1faa07c, 40480eee361ed9676b3f844d532ac28b47251634, 6.6.148, 6.12.101, 6.18.42, 7.1.6 |
Published upstream
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 10, 2026
In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPH_MSG_MON_MAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the existing monitors in the cluster. Currently, a monmap indicating that there are zero monitors in the cluster is treated as valid. However, it is impossible to have zero monitors in the cluster and still receive a valid monmap from a monitor. Therefore, such a monmap must be corrupted and should be treated as invalid. Furthermore, a monmap with a monitor count of zero can subsequently crash the client when attempting to open a session with a monitor in __open_session(). This happens because the "BUG_ON(monc->monmap->num_mon < 1)" assertion in pick_new_mon() is triggered. This patch extends a check in ceph_monmap_decode() to also reject arriving mon_maps with num_mon == 0 rather than only with num_mon > CEPH_MAX_MON. [ idryomov: drop "log output for unusual values of num_mon" part ]
Quoted source text, attributed separately from HOL analysis.