CVE-2026-68155libceph: Reject monmaps advertising zero monitors
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPH_MSG_MON_MAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the existing monitors in the cluster. Currently, a monmap indicating that there are zero monitors in the cluster is treated as valid. However, it is impossible to have zero monitors in the cluster and still receive a valid monmap from a monitor. Therefore, such a monmap must be corrupted and should be treated as invalid. Furthermore, a monmap with a monitor count of zero can subsequently crash the client when attempting to open a session with a monitor in __open_session(). This happens because the "BUG_ON(monc->monmap->num_mon < 1)" assertion in pick_new_mon() is triggered. This patch extends a check in ceph_monmap_decode() to also reject arriving mon_maps with num_mon == 0 rather than only with num_mon > CEPH_MAX_MON. [ idryomov: drop "log output for unusual values of num_mon" part ]
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from ba75bb98cfb93b62c54af25bf67ff90857264bbe before ba5f0015bfd376d764163045a61c17be75f44dae; from ba75bb98cfb93b62c54af25bf67ff90857264bbe before caf082ef8609a6ac26159ce115f55ab7d00231a3; from ba75bb98cfb93b62c54af25bf67ff90857264bbe before e3ccd4ecab09b22f507f49cb7ed9990c7158ceab; from ba75bb98cfb93b62c54af25bf67ff90857264bbe before 0591a15815b498be628a937146e44487d599ba33; from ba75bb98cfb93b62c54af25bf67ff90857264bbe before cd0d41bc569632eaaeccde9d2a6bc919ec00c407; from ba75bb98cfb93b62c54af25bf67ff90857264bbe before e67e8b694872c9bc66996040f9de9242f6236ed9; from ba75bb98cfb93b62c54af25bf67ff90857264bbe before 3b249546f59c3d6d3592c10657f82bc3f1faa07c; from ba75bb98cfb93b62c54af25bf67ff90857264bbe before 40480eee361ed9676b3f844d532ac28b47251634 | CNA record |
References
- https://git.kernel.org/stable/c/ba5f0015bfd376d764163045a61c17be75f44dae
- https://git.kernel.org/stable/c/caf082ef8609a6ac26159ce115f55ab7d00231a3
- https://git.kernel.org/stable/c/e3ccd4ecab09b22f507f49cb7ed9990c7158ceab
- https://git.kernel.org/stable/c/0591a15815b498be628a937146e44487d599ba33
- https://git.kernel.org/stable/c/cd0d41bc569632eaaeccde9d2a6bc919ec00c407
- https://git.kernel.org/stable/c/e67e8b694872c9bc66996040f9de9242f6236ed9
- https://git.kernel.org/stable/c/3b249546f59c3d6d3592c10657f82bc3f1faa07c
- https://git.kernel.org/stable/c/40480eee361ed9676b3f844d532ac28b47251634
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.