CVE-2026-68433libceph: bound get_version reply decode to front len
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: libceph: bound get_version reply decode to front len handle_get_version_reply() uses msg->front_alloc_len as the decode boundary for MON_GET_VERSION_REPLY. That is the size of the reused reply buffer, not the number of bytes actually received. A truncated reply can therefore pass ceph_decode_need() and decode the second u64 from stale tail bytes left in the buffer by an earlier message, causing an uninitialized memory read. Use msg->front.iov_len as the receive-side decode boundary, matching other libceph reply handlers and limiting decoding to the bytes that were actually read from the wire.
- CVSS
- 8.6 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 before 1307028f082756bf453e1889aee9983d30643a4b; from 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 before f6cbf6878f3a1503c872ba8f1e69a58ee68d8b2e; 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 builds before 72a35070fcefa229b1b031aa7482ad3788e18f07; 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 builds before 340e0386aa39da181015bee38f309018c335ce16; from 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 before d60de8253c85a02d0e6194b0735e7a562981a04c; 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 builds before 4e7ebfaa0d14cf50e44041bfde38070d6dbc019f; 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 builds before 0d934c934ec746d53fc7e4f53239792647bbae63; from 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 before d3c32939fa0e3ee9b883b9a0fd1972c5c444e3d0 | CNA record |
References
- https://git.kernel.org/stable/c/1307028f082756bf453e1889aee9983d30643a4b
- https://git.kernel.org/stable/c/f6cbf6878f3a1503c872ba8f1e69a58ee68d8b2e
- https://git.kernel.org/stable/c/72a35070fcefa229b1b031aa7482ad3788e18f07
- https://git.kernel.org/stable/c/340e0386aa39da181015bee38f309018c335ce16
- https://git.kernel.org/stable/c/d60de8253c85a02d0e6194b0735e7a562981a04c
- https://git.kernel.org/stable/c/4e7ebfaa0d14cf50e44041bfde38070d6dbc019f
- https://git.kernel.org/stable/c/0d934c934ec746d53fc7e4f53239792647bbae63
- https://git.kernel.org/stable/c/d3c32939fa0e3ee9b883b9a0fd1972c5c444e3d0
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.