Answer in brief
CVE-2026-68159 records a Critical severity (CVSS 9.8) vulnerability in libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=a303bb0e58345fe9f7ab2f82b90266f2b5036058 <e36663145abd7024f0281dfb22fdef65f185845b || >=a303bb0e58345fe9f7ab2f82b90266f2b5036058 <9f00f9cf2be293efe899db67dc5272e3a9c62717 | e36663145abd7024f0281dfb22fdef65f185845b, 9f00f9cf2be293efe899db67dc5272e3a9c62717 |
| Linux/Linuxgeneric | 4.13 | Not reported |
| Linux/Linuxgeneric | >=a303bb0e58345fe9f7ab2f82b90266f2b5036058 <66eec4af1e080b695229c9a20635648a6d12fedf || >=a303bb0e58345fe9f7ab2f82b90266f2b5036058 <4daf06456677177f2a6044729abac59c1b49e87b || >=a303bb0e58345fe9f7ab2f82b90266f2b5036058 <d5650ddbd4d42c1a916c8fe1a4c4cb573ef810a1 || >=a303bb0e58345fe9f7ab2f82b90266f2b5036058 <42bc06c67d94d5f2a6b33294b0c4b07d8a47c515 || >=a303bb0e58345fe9f7ab2f82b90266f2b5036058 <ebdf4b4f3b1474079980a2e5cd79ad65fb54db57 || >=a303bb0e58345fe9f7ab2f82b90266f2b5036058 <590b07ceea138d49c9b64f65d263aa902d3b4730 || >=a303bb0e58345fe9f7ab2f82b90266f2b5036058 <e36663145abd7024f0281dfb22fdef65f185845b || >=a303bb0e58345fe9f7ab2f82b90266f2b5036058 <9f00f9cf2be293efe899db67dc5272e3a9c62717 | 66eec4af1e080b695229c9a20635648a6d12fedf, 4daf06456677177f2a6044729abac59c1b49e87b, d5650ddbd4d42c1a916c8fe1a4c4cb573ef810a1, 42bc06c67d94d5f2a6b33294b0c4b07d8a47c515, ebdf4b4f3b1474079980a2e5cd79ad65fb54db57, 590b07ceea138d49c9b64f65d263aa902d3b4730, e36663145abd7024f0281dfb22fdef65f185845b, 9f00f9cf2be293efe899db67dc5272e3a9c62717 |
Published upstream
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 10, 2026
In the Linux kernel, the following vulnerability has been resolved: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE __decode_pg_temp() decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPH_PG_MAX_SIZE. The helper backs both pg_temp and pg_upmap decoding, and apply_upmap()/get_temp_osds() later copy the decoded list into the fixed-size on-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE]. A monitor that sends an OSDMap with a pg_temp/pg_upmap entry longer than 32 thus causes a stack out-of-bounds write. An OSD set for a single PG can never exceed CEPH_PG_MAX_SIZE, so reject longer entries at decode time. The bound is well below the old overflow threshold, so it also covers the allocation-size overflow the previous check guarded against. BUG: KASAN: stack-out-of-bounds in ceph_pg_to_up_acting_osds Write of size 4 ... by task exploit kasan_report (mm/kasan/report.c:595) ceph_pg_to_up_acting_osds (net/ceph/osdmap.c:2617 net/ceph/osdmap.c:2833) calc_target (net/ceph/osd_client.c:1638) __submit_request (net/ceph/osd_client.c:2394) ceph_osdc_start_request (net/ceph/osd_client.c:2490) ceph_osdc_call (net/ceph/osd_client.c:5164) rbd_dev_image_probe (drivers/block/rbd.c:6899) do_rbd_add (drivers/block/rbd.c:7138) ... kernel BUG at net/ceph/osdmap.c:2670! [ idryomov: do the same in __decode_pg_upmap_items() ]
Quoted source text, attributed separately from HOL analysis.