{"id":"CVE-2026-68158","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-68158","summary":"libceph: Fix multiplication overflow in decode_new_up_state_weight()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Fix multiplication overflow in decode_new_up_state_weight()\n\nIf a message of type CEPH_MSG_OSD_MAP contains a (maliciously) corrupted\nosdmap, out-of-bounds memory accesses may occur in\ndecode_new_up_state_weight(). This happens because the bounds check for\nthe new_state part is based on calculating its length depending on a len\nvalue read from the incoming message. This calculation may overflow\nleading to an incorrect bounds check. Subsequently, out-of-bounds reads\nmay occur when decoding this part.\n\nThis patch switches the multiplication to use check_mul_overflow() to\nabort processing the osdmap if an overflow occurred. Therefore,\nosdmaps/messages containing large values for len that result in a\nmultiplication overflow are treated as invalid.\n\n[ idryomov: rename new_state_len -> new_state_item_size, formatting ]","published":"2026-08-10T11:59:24.675Z","modified":"2026-08-14T04:03:21.433613889Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Linux","name":"Kernel","fixedVersion":"6.6.148"}],"fix":null,"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/05c90e059269f087becfcce23348496085835c29"},{"type":"WEB","url":"https://git.kernel.org/stable/c/143ba49ead77ec483c0326f8aaad8649874e99c4"},{"type":"WEB","url":"https://git.kernel.org/stable/c/1732d89dfcd74f6fde9ce70900d316c4a151c153"},{"type":"WEB","url":"https://git.kernel.org/stable/c/98917a499ec7064c14fc56d180a4fd636fc2784c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/bee4b5b53e7bff0467fd916cc44c9b190733c6bd"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68158.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68158"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-14T04:03:21.433613889Z"}}