CVE-2026-68157

HighCVSS 7.5/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

libceph: guard missing CRUSH type name lookup

Localized read selection can walk a parent bucket whose name exists in the CRUSH map while its type has no matching entry in type_names. get_immediate_parent() then dereferences a NULL type_cn and passes an invalid pointer into strcmp(), causing a null-ptr-deref.

Skip such malformed parent buckets unless both the bucket name and type name metadata are present. This keeps malformed hierarchy data from crashing locality lookup and safely falls back to "not local".

[ idryomov: add WARN_ON_ONCE ]

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 117d96a04f007ce8fc2e292369056c3bd09f6f63, < cbfcba275326c8c7dae9acd8f4a0d4c316fdafb0; >= 117d96a04f007ce8fc2e292369056c3bd09f6f63, < 8ff579ac03d6e9d17d6d9c8443110167c14a382d; >= 117d96a04f007ce8fc2e292369056c3bd09f6f63, < 6a4b75d90f0cfbf22c14742ab35a803bc13f36ec; >= 117d96a04f007ce8fc2e292369056c3bd09f6f63, < c46d82c47afc968d6ee8ef4470fa2dd35b765c21; >= 117d96a04f007ce8fc2e292369056c3bd09f6f63, < 3767c9f0c1bbd98dd25cb088356a0fc6c1f09f50; >= 117d96a04f007ce8fc2e292369056c3bd09f6f63, < 4716a64b7cc2797741f7be4e283ace78a9dff37d; >= 117d96a04f007ce8fc2e292369056c3bd09f6f63, < db9cc9fd9660b2d69ee66f5a4cbec83c21a1c64d; >= 117d96a04f007ce8fc2e292369056c3bd09f6f63, < bbeae12fda3384a90fbebc8a19ba9d33f85b5361
LinuxLinux5.8

References

Timeline

Published
Aug 10, 2026
Last modified
Oct 19, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-681589.8In the Linux kernel, the following vulnerability has been resolved: libceph: Fix multiplication overflow in decode_new_up_state_weight() ICVE-2026-681599.8In the Linux kernel, the following vulnerability has been resolved: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE CVE-2026-68163.8An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery coCVE-2026-681609.8In the Linux kernel, the following vulnerability has been resolved: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps(CVE-2026-681619.8In the Linux kernel, the following vulnerability has been resolved: sctp: close UDP tunnel sockets during netns teardown proc_sctp_do_udp_CVE-2026-681627.8In the Linux kernel, the following vulnerability has been resolved: sctp: avoid auth_enable sysctl UAF during netns teardown proc_sctp_do_CVE-2026-681637.8In the Linux kernel, the following vulnerability has been resolved: mm/page_vma_mapped: fix device-private PMD handling Commit 65edfda6f3fCVE-2026-68164In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: disallow overlapping input ranges for damon_set_regions(CVE-2026-68165In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: validate ranges in damon_set_regions() DAMON core logicCVE-2026-68166In the Linux kernel, the following vulnerability has been resolved: userfaultfd: prevent registration of special VMAs Vova Tokarev says: CVE-2026-68167In the Linux kernel, the following vulnerability has been resolved: btrfs: do not try compression for data reloc inodes [BUG] There is a sCVE-2026-68168In the Linux kernel, the following vulnerability has been resolved: afs: Fix afs_edit_dir_remove() to get, not find, block 0 Fix afs_edit_
CVE-2026-68157: High severity, CVSS 7.5 | Vulnix