CRITICAL Introduced in 2.6.34
libceph CrushBucket OOB
CVE-2026-68154
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crush_decode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crush_decode() accepts a bucket with type 0, a malformed CRUSH map can make the mapper treat a negative bucket ID as a device and pass it to is_out(), which then indexes the OSD weight array with a negative value. Reject zero bucket types while decoding the CRUSH map so the invalid state never reaches the mapper.
02KernelScan AI Analysis
Risk summary
Systems using the kernel Ceph client are at risk when connected to a malicious or compromised Ceph monitor. A malformed CRUSH map causes the kernel to access the OSD weight array with an attacker-controlled negative offset, leading to a kernel crash. No client-side privileges are required.
Vulnerability analysis
The Ceph client's CRUSH map decoder incorrectly accepts bucket type 0, which is reserved for devices. A malicious or compromised Ceph monitor can supply a CRUSH map containing a type-0 bucket with a negative ID, causing the mapper to treat that ID as a device index and access the OSD weight array out of bounds. The fix rejects type-0 buckets during decoding so the invalid state never reaches the mapper. Any system using the kernel Ceph client is affected; the attack requires no client-side privileges, only a malicious or MITM'd Ceph monitor sending the malformed map.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 2.6.34 | 5.10.265 | 952ca5dc9991 |
| 5.15 | 2.6.34 | 5.15.216 | 146461f09565 |
| 6.1 | 2.6.34 | 6.1.183 | 80fc40e11cda |
| 6.12 | 2.6.34 | 6.12.101 | 826cd1de5802 |
| 6.18 | 2.6.34 | 6.18.42 | 3b2f1937f5fc |
| 6.6 | 2.6.34 | 6.6.148 | b8a9fb6bf806 |
| 7.1 | 2.6.34 | 7.1.6 | 70998f91030e |
| mainline | 2.6.34 | 7.2 | 05f902842233 |
| cip/4.19 | 2.6.34 | 4.19.325-cip136 | 8138cbd7f3ca |
| cip/4.19-rt | 2.6.34 | 4.19.325-cip136-rt50 | 8138cbd7f3ca |
| cip/4.4 | 2.6.34 | 4.4.302-cip115 | e45f8aa5ce86 |
| cip/4.4-rt | 2.6.34 | 4.4.302-cip115-rt63 | e45f8aa5ce86 |
| cip/5.10 | 2.6.34 | 5.10.268-cip77 | 952ca5dc9991 |
| cip/5.10-rt | 2.6.34 | 5.10.268-cip77-rt34 | 952ca5dc9991 |
| cip/6.1 | 2.6.34 | 6.1.187-cip60 | 80fc40e11cda |
| cip/6.1-rt | 2.6.34 | 6.1.189-cip61-rt32 | 80fc40e11cda |
| cip/6.12 | 2.6.34 | 6.12.101-cip29 | 826cd1de5802 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.101-cip29 |
| cip/6.1 | Fixed in 6.1.187-cip60 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.268-cip77 |
| cip/5.10-rt | Fixed in 5.10.268-cip77-rt34 |
| cip/4.19 | Fixed in 4.19.325-cip136 |
| cip/4.19-rt | Fixed in 4.19.325-cip136-rt50 |
| cip/4.4 | Fixed in 4.4.302-cip115 |
| cip/4.4-rt | Fixed in 4.4.302-cip115-rt63 |