CVE-2026-68160

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()

ceph_handle_caps() reads snap_trace_len from the wire-format

ceph_mds_caps header and uses it unconditionally to build a fake

end pointer (snaptrace + snaptrace_len) that is later handed to

ceph_update_snap_trace() in the CEPH_CAP_OP_IMPORT case:

snaptrace = h + 1;

snaptrace_len = le32_to_cpu(h->snap_trace_len);

p = snaptrace + snaptrace_len;

...

case CEPH_CAP_OP_IMPORT:

if (snaptrace_len) {

...

if (ceph_update_snap_trace(mdsc, snaptrace,

snaptrace + snaptrace_len,

false, &realm)) { ... }

ceph_update_snap_trace() then decodes a struct ceph_mds_snap_realm

from snaptrace using ceph_decode_need(&p, e, sizeof(*ri), bad)

with the attacker-supplied fake end e == snaptrace + snaptrace_len.

With snaptrace_le

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References