CVE-2026-68158libceph: Fix multiplication overflow in decode_new_up_state_weight()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix multiplication overflow in decode_new_up_state_weight() If a message of type CEPH_MSG_OSD_MAP contains a (maliciously) corrupted osdmap, out-of-bounds memory accesses may occur in decode_new_up_state_weight(). This happens because the bounds check for the new_state part is based on calculating its length depending on a len value read from the incoming message. This calculation may overflow leading to an incorrect bounds check. Subsequently, out-of-bounds reads may occur when decoding this part. This patch switches the multiplication to use check_mul_overflow() to abort processing the osdmap if an overflow occurred. Therefore, osdmaps/messages containing large values for len that result in a multiplication overflow are treated as invalid. [ idryomov: rename new_state_len -> new_state_item_size, formatting ]
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 930c532869774ebf8af9efe9484c597f896a7d46 builds before 2ceee3b77b83052648c40fef965f836fd7699d26; from 930c532869774ebf8af9efe9484c597f896a7d46 before e4473751cc37db41f3f7da25d64a23e0c74570f1; from 930c532869774ebf8af9efe9484c597f896a7d46 before f6961070c326bd158c38fa48756cde2bd78c4aaa; 930c532869774ebf8af9efe9484c597f896a7d46 builds before 05c90e059269f087becfcce23348496085835c29; 930c532869774ebf8af9efe9484c597f896a7d46 builds before 143ba49ead77ec483c0326f8aaad8649874e99c4; from 930c532869774ebf8af9efe9484c597f896a7d46 before 1732d89dfcd74f6fde9ce70900d316c4a151c153; from 930c532869774ebf8af9efe9484c597f896a7d46 before bee4b5b53e7bff0467fd916cc44c9b190733c6bd; from 930c532869774ebf8af9efe9484c597f896a7d46 before 98917a499ec7064c14fc56d180a4fd636fc2784c; and 16 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/2ceee3b77b83052648c40fef965f836fd7699d26
- https://git.kernel.org/stable/c/e4473751cc37db41f3f7da25d64a23e0c74570f1
- https://git.kernel.org/stable/c/f6961070c326bd158c38fa48756cde2bd78c4aaa
- https://git.kernel.org/stable/c/05c90e059269f087becfcce23348496085835c29
- https://git.kernel.org/stable/c/143ba49ead77ec483c0326f8aaad8649874e99c4
- https://git.kernel.org/stable/c/1732d89dfcd74f6fde9ce70900d316c4a151c153
- https://git.kernel.org/stable/c/bee4b5b53e7bff0467fd916cc44c9b190733c6bd
- https://git.kernel.org/stable/c/98917a499ec7064c14fc56d180a4fd636fc2784c
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.