In the Linux kernel, the following vulnerability has been resolved:

libceph: reject zero bucket types in crush_decode

CRUSH bucket type 0 is reserved for devices. The mapper relies on
that invariant and uses type 0 to identify leaf devices.

If crush_decode() accepts a bucket with type 0, a malformed CRUSH map
can make the mapper treat a negative bucket ID as a device and pass it
to is_out(), which then indexes the OSD weight array with a negative
value.

Reject zero bucket types while decoding the CRUSH map so the invalid
state never reaches the mapper.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
f24e9980eb860d8600cbe5ef3d2fd9295320d229 affected < b8a9fb6bf806f9c4891e71ae1beab0c07c23a877
f24e9980eb860d8600cbe5ef3d2fd9295320d229 affected < 826cd1de5802fd392922785f9b64d76e65d2a100
f24e9980eb860d8600cbe5ef3d2fd9295320d229 affected < 3b2f1937f5fce8b7dd5432e7693e3cc8b5eece56
f24e9980eb860d8600cbe5ef3d2fd9295320d229 affected < 70998f91030ee083ecb336a1dff0701c20a38081
f24e9980eb860d8600cbe5ef3d2fd9295320d229 affected < 05f90284223381005d6bcddab3fda4a97f9c3401
Linux Linux affected
Version Status Constraints
2.6.34 affected —
0 unaffected < 2.6.34
6.6.148 unaffected ≤ 6.6.*
6.12.101 unaffected ≤ 6.12.*
6.18.42 unaffected ≤ 6.18.*
7.1.6 unaffected ≤ 7.1.*
7.2-rc5 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/05f90284223381005d6bcddab3fda4a97f9c3401 cve-icon
https://git.kernel.org/stable/c/3b2f1937f5fce8b7dd5432e7693e3cc8b5eece56 cve-icon
https://git.kernel.org/stable/c/70998f91030ee083ecb336a1dff0701c20a38081 cve-icon
https://git.kernel.org/stable/c/826cd1de5802fd392922785f9b64d76e65d2a100 cve-icon
https://git.kernel.org/stable/c/b8a9fb6bf806f9c4891e71ae1beab0c07c23a877 cve-icon
History

Mon, 10 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-129

Mon, 10 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crush_decode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crush_decode() accepts a bucket with type 0, a malformed CRUSH map can make the mapper treat a negative bucket ID as a device and pass it to is_out(), which then indexes the OSD weight array with a negative value. Reject zero bucket types while decoding the CRUSH map so the invalid state never reaches the mapper.
Title libceph: reject zero bucket types in crush_decode
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-10T11:59:20.250Z

Reserved: 2026-07-30T09:28:09.371Z

Link: CVE-2026-68154

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-10T16:45:03Z

Weaknesses