CVE-2026-68157
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
In the Linux kernel's libceph module, a NULL pointer dereference can occur during localized read selection when a CRUSH type name is missing. The fix skips such malformed parent buckets unless both bucket name and type name metadata are present.
Risk Assessment
A corrupted CRUSH map can cause a system crash (null-ptr-deref) during read operations, potentially leading to service unavailability.
Recommendation
Update the Linux kernel and validate CRUSH maps before use.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: libceph: guard missing CRUSH type name lookup Localized read selection can walk a parent bucket whose name exists in the CRUSH map while its type has no matching entry in type_names. get_immediate_parent() then dereferences a NULL type_cn and passes an invalid pointer into strcmp(), causing a null-ptr-deref. Skip such malformed parent buckets unless both the bucket name and type name metadata are present. This keeps malformed hierarchy data from crashing locality lookup and safely falls back to "not local". [ idryomov: add WARN_ON_ONCE ]