HIGH Introduced in 5.8
libceph CrushType Deref
CVE-2026-68157
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: libceph: guard missing CRUSH type name lookup Localized read selection can walk a parent bucket whose name exists in the CRUSH map while its type has no matching entry in type_names. get_immediate_parent() then dereferences a NULL type_cn and passes an invalid pointer into strcmp(), causing a null-ptr-deref. Skip such malformed parent buckets unless both the bucket name and type name metadata are present. This keeps malformed hierarchy data from crashing locality lookup and safely falls back to "not local". [ idryomov: add WARN_ON_ONCE ]
02KernelScan AI Analysis
Risk summary
A Ceph client kernel can be crashed by a malformed CRUSH map received from a Ceph monitor. The vulnerability is a NULL pointer dereference triggered during localized read selection when a parent bucket's type has no matching entry in the type_names list. Any Linux system acting as a Ceph client (CephFS mount or RBD usage) connected to a compromised or malicious monitor is at risk of a kernel panic, resulting in full system unavailability.
Vulnerability analysis
When a Ceph client processes a CRUSH map that contains a parent bucket whose name is present but whose type metadata is missing, the local read selection code looks up the type name, receives a NULL pointer, and dereferences it — causing a kernel panic. The malformed map data arrives from the Ceph monitor over the network as part of the normal OSD map distribution; no client-side privileges are required to trigger the crash, only an active read operation that exercises the local selection logic. The fix adds a check after the type name lookup and skips any bucket whose type name is missing, safely falling back to treating the data as non-local instead of crashing. This vulnerability is reachable only on systems running a Ceph client (CephFS or RBD) connected to a Ceph cluster where the monitor distributes a malformed or maliciously crafted CRUSH map.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 5.8 | 5.10.265 | cbfcba275326 |
| 5.15 | 5.8 | 5.15.216 | 8ff579ac03d6 |
| 6.1 | 5.8 | 6.1.183 | 6a4b75d90f0c |
| 6.12 | 5.8 | 6.12.101 | 3767c9f0c1bb |
| 6.18 | 5.8 | 6.18.42 | 4716a64b7cc2 |
| 6.6 | 5.8 | 6.6.148 | c46d82c47afc |
| 7.1 | 5.8 | 7.1.6 | db9cc9fd9660 |
| mainline | 5.8 | 7.2 | bbeae12fda33 |
| cip/5.10 | 5.8 | 5.10.268-cip77 | cbfcba275326 |
| cip/5.10-rt | 5.8 | 5.10.268-cip77-rt34 | cbfcba275326 |
| cip/6.1 | 5.8 | 6.1.187-cip60 | 6a4b75d90f0c |
| cip/6.1-rt | 5.8 | 6.1.189-cip61-rt32 | 6a4b75d90f0c |
| cip/6.12 | 5.8 | 6.12.101-cip29 | 3767c9f0c1bb |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.101-cip29 |
| cip/6.1 | Fixed in 6.1.187-cip60 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.268-cip77 |
| cip/5.10-rt | Fixed in 5.10.268-cip77-rt34 |