CVE-2026-68154
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
In the Linux kernel's libceph module, CRUSH bucket type 0 was accepted, potentially leading to indexing the OSD weight array with a negative value. The fix rejects such types during CRUSH map decoding.
Risk Assessment
A corrupted CRUSH map can cause incorrect behavior or system crash, potentially leading to service unavailability.
Recommendation
Update the Linux kernel and validate CRUSH maps before use.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crush_decode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crush_decode() accepts a bucket with type 0, a malformed CRUSH map can make the mapper treat a negative bucket ID as a device and pass it to is_out(), which then indexes the OSD weight array with a negative value. Reject zero bucket types while decoding the CRUSH map so the invalid state never reaches the mapper.