CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight()

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-10 · updated 2026-10-19
Weakness: CWE-190

Description

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix multiplication overflow in decode_new_up_state_weight() If a message of type CEPH_MSG_OSD_MAP contains a (maliciously) corrupted osdmap, out-of-bounds memory accesses may occur in decode_new_up_state_weight(). This happens because the bounds check for the new_state part is based on calculating its length depending on a len value read from the incoming message. This calculation may overflow leading to an incorrect bounds check. Subsequently, out-of-bounds reads may occur when decoding this part. This patch switches the multiplication to use check_mul_overflow() to abort processing the osdmap if an overflow occurred. Therefore, osdmaps/messages containing large values for len that result in a multiplication overflow are treated as invalid. [ idryomov: rename new_state_len -> new_state_item_size, formatting ]

Affected products

Linux kernel: from 3.10.103 before 3.11; from 3.12.63 before 3.13; from 3.14.75 before 3.15; from 3.16.39 before 3.17; from 3.18.39 before 3.19; from 4.1.30 before 4.2 — fixed in 3.11, 3.13, 3.15, 3.17, 3.19, 4.2

How to fix

Upgrade to a fixed version: Linux kernel 3.11, 3.13, 3.15, 3.17. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-68158 or the next vulnerability affects your stack