CVE-2026-68159

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE

__decode_pg_temp() decodes an user-controlled length but only rejects

values large enough to overflow the allocation; it does not bound it to

CEPH_PG_MAX_SIZE. The helper backs both pg_temp and pg_upmap decoding, and

apply_upmap()/get_temp_osds() later copy the decoded list into the fixed-size

on-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE]. A monitor that sends

an OSDMap with a pg_temp/pg_upmap entry longer than 32 thus causes a stack

out-of-bounds write.

An OSD set for a single PG can never exceed CEPH_PG_MAX_SIZE, so reject longer

entries at decode time. The bound is well below the old overflow threshold, so

it also covers the allocation-size overflow the previous check guarded against.

BUG: KASAN: stack-out-of-bounds in ceph_pg_to_up_acting_osds

Write of size 4 ... by task exploit

kasan_report (mm/kasan/report.c:595)

ceph_pg_

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References