Critical

CVE-2026-68158 — libceph: Fix multiplication overflow in decode_new_up_state_weight()

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix multiplication overflow in decode_new_up_state_weight() If a message of type CEPH_MSG_OSD_MAP contains a (maliciously) corrupted osdmap, out-of-bounds memory accesses may occur in decode_new_up_state_weight(). This happens because the bounds check for the new_state part is based on calculating its length depending on a len value read from the incoming message. This calculation may overflow leading to an incorrect bounds check. Subsequently, out-of-bounds reads may occur when decoding this part. This patch switches the multiplication to use check_mul_overflow() to abort processing the osdmap if an overflow occurred. Therefore, osdmaps/messages containing large values for len that result in a multiplication overflow are treated as invalid. [ idryomov: rename new_state_len -> new_state_item_size, formatting ]

Published Aug 10, 2026 · Updated Oct 15, 2026 · Sources: NIST National Vulnerability Database, CVE Program (cve.org) e CISA ADP · CNA: Linux

Low

Who exploits it and how urgent it is

A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.

No exploitation signal in the sources consulted so far.

How the score was calculated

Technical severity (critical)+10

The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.

Exploitation

Not confirmed

Not in CISA KEV — an absence of record, not proof it is unexploited.

EPSS FIRST

—

No EPSS score.

Affects

Linux

CVSS base

9.8

Critical · 2 source(s)

Remediation

Fixes and mitigations documented by the sources — linked to the original advisory.

No fix documented by the sources we poll. That does not mean none exists: check the vendor advisory.

First 24 hours

Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.

Identify exposed assets running the affected vendor/product/version combinations (Linux Linux).
The attack is network-based and needs no privileges: restrict exposure (ACLs, VPN, WAF) until patched.
No fix documented in the sources: reduce exposure and monitor the vendor advisory.
Search available logs for exploit probes, errors and authentication anomalies.

Affected scope

Vendor, product and versions as the sources word them.

Vendor	Product	Versions	Status	Source
Linux	Linux	version 8777c9f654637d56f4c4ca54eb1bc7c609b70085version 4.7≥ 4.6.6 and < 4.7≥ 4.4.17 and < 4.5≥ 4.1.30 and < 4.2≥ 3.18.39 and < 3.19≥ 3.16.39 and < 3.17≥ 3.14.75 and < 3.15 and 17 more ≥ 3.12.63 and < 3.13≥ 3.10.103 and < 3.11version 14877928f10667a5606383885d004f7185f33718version 032951d32c13b7564dfba82758260cb7aa1149d2version 6831c98ce0b8a3e88db64aa224372effd0dcc694≥ 930c532869774ebf8af9efe9484c597f896a7d46 and < 2ceee3b77b83052648c40fef965f836fd7699d26version 7405d73cea0d0e6c541f5c534078feeb46188844version 6b96b2d473701b45df3fea8dd9796b6ec39e6d54version bbc3aa6b0e6050b2b2e04a08dd4d6423d576b196version 1196c36fd53c3b1615eb02f986cb727b1dfc1047≥ 930c532869774ebf8af9efe9484c597f896a7d46 and < 98917a499ec7064c14fc56d180a4fd636fc2784c≥ 930c532869774ebf8af9efe9484c597f896a7d46 and < bee4b5b53e7bff0467fd916cc44c9b190733c6bd≥ 930c532869774ebf8af9efe9484c597f896a7d46 and < 1732d89dfcd74f6fde9ce70900d316c4a151c153≥ 930c532869774ebf8af9efe9484c597f896a7d46 and < 143ba49ead77ec483c0326f8aaad8649874e99c4≥ 930c532869774ebf8af9efe9484c597f896a7d46 and < 05c90e059269f087becfcce23348496085835c29≥ 930c532869774ebf8af9efe9484c597f896a7d46 and < f6961070c326bd158c38fa48756cde2bd78c4aaa≥ 930c532869774ebf8af9efe9484c597f896a7d46 and < e4473751cc37db41f3f7da25d64a23e0c74570f1	Vulnerable	CVE Program (cve.org) e CISA ADP

Attack characteristics

The CVSS vector, decoded. It describes the attack, not your exposure to it.

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Every base score collected

Sources score independently and may disagree; each row says who scored it and under which version.

Score	Version	Severity	Expl.	Impact	Scored by
9.8	CVSS 3.1	Critical	3.9	5.9	416baaa9-dc9f-4396-8d5f-8c081fb06d67 via NIST National Vulnerability Database
9.8	CVSS 3.1	Critical	—	—	Linux via CVE Program (cve.org) e CISA ADP

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (score shown at the top: 416baaa9-dc9f-4396-8d5f-8c081fb06d67)

Detection

Read off the CVSS vector and the weakness class. Starting points, not tested rules.

Prioritize edge telemetry for the network-reachable component (proxy, WAF, IDS/IPS).

web/proxy/WAF logsnetwork IDS/IPS

Timeline

What happened to this CVE, newest first.

2026
Affected products added · linux/linux
Oct 15, 2026 · CVE Program (cve.org) e CISA ADP
Record published
Oct 15, 2026
CVSS changed · 9.8
Oct 15, 2026 · NIST National Vulnerability Database
Source status changed · → Received
Oct 15, 2026 · NIST National Vulnerability Database
Record created in this database
Oct 15, 2026 · NIST National Vulnerability Database
CVE published
Aug 10, 2026 · Linux

Source activity

Repeated readings are counted rather than listed.

1× Official description updated · Oct 15, 2026 – Oct 15, 2026

References

8 on the record

git.kernel.org/stable/c/2ceee3b77b83052648c40fef965f836fd7699d26
NIST National Vulnerability Database
git.kernel.org/stable/c/143ba49ead77ec483c0326f8aaad8649874e99c4
NIST National Vulnerability Database
git.kernel.org/stable/c/1732d89dfcd74f6fde9ce70900d316c4a151c153
NIST National Vulnerability Database
git.kernel.org/stable/c/e4473751cc37db41f3f7da25d64a23e0c74570f1
NIST National Vulnerability Database
git.kernel.org/stable/c/bee4b5b53e7bff0467fd916cc44c9b190733c6bd
NIST National Vulnerability Database
git.kernel.org/stable/c/05c90e059269f087becfcce23348496085835c29
NIST National Vulnerability Database
git.kernel.org/stable/c/98917a499ec7064c14fc56d180a4fd636fc2784c
NIST National Vulnerability Database
git.kernel.org/stable/c/f6961070c326bd158c38fa48756cde2bd78c4aaa
NIST National Vulnerability Database

Elsewhere on this site

Linux
every CVE for this vendor

Related CVEs (same products)

Critical CVE-2026-99999 ipv4: validate checksum_start before completing checksum 12h
Unknown CVE-2026-98432 ipv4: free inet_opt and ireq_opt after an RCU grace period 12h
Unknown CVE-2026-98428 ALSA: usb: 6fire: Avoid embedded URBs 1d
Unknown CVE-2026-98431 RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency 1d
Unknown CVE-2026-98430 RDMA/efa: Keep admin queues alive while IRQ is registered 1d
Unknown CVE-2026-98429 RDMA/efa: Keep EQ resources alive while IRQ is registered 1d

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

No FIRST EPSS score.
No fixed version, patch or mitigation documented.
No CISA SSVC assessment.
No CWE classification.
No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
No exploit packet captures, log samples, or incident case IDs supplied.

Answered from this record

Text assembled only from the fields above — no additional claims.

What should defenders know first?

CVE-2026-68158 is "libceph: Fix multiplication overflow in decode_new_up_state_weight()", rated Critical. It affects Linux (Linux); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. CVSS 9.8 describes technical severity. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.

Comments

Moderated technical discussion. Read the community guidelines.

No comments yet.