GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-68159 (GCVE-0-2026-68159)

Vulnerability from cvelistv5 – Published: 2026-08-10 11:59 – Updated: 2026-08-23 12:46
VLAI
Title
libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
Summary
In the Linux kernel, the following vulnerability has been resolved: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE __decode_pg_temp() decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPH_PG_MAX_SIZE. The helper backs both pg_temp and pg_upmap decoding, and apply_upmap()/get_temp_osds() later copy the decoded list into the fixed-size on-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE]. A monitor that sends an OSDMap with a pg_temp/pg_upmap entry longer than 32 thus causes a stack out-of-bounds write. An OSD set for a single PG can never exceed CEPH_PG_MAX_SIZE, so reject longer entries at decode time. The bound is well below the old overflow threshold, so it also covers the allocation-size overflow the previous check guarded against. BUG: KASAN: stack-out-of-bounds in ceph_pg_to_up_acting_osds Write of size 4 ... by task exploit kasan_report (mm/kasan/report.c:595) ceph_pg_to_up_acting_osds (net/ceph/osdmap.c:2617 net/ceph/osdmap.c:2833) calc_target (net/ceph/osd_client.c:1638) __submit_request (net/ceph/osd_client.c:2394) ceph_osdc_start_request (net/ceph/osd_client.c:2490) ceph_osdc_call (net/ceph/osd_client.c:5164) rbd_dev_image_probe (drivers/block/rbd.c:6899) do_rbd_add (drivers/block/rbd.c:7138) ... kernel BUG at net/ceph/osdmap.c:2670! [ idryomov: do the same in __decode_pg_upmap_items() ]
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a303bb0e58345fe9f7ab2f82b90266f2b5036058 , < 66eec4af1e080b695229c9a20635648a6d12fedf (git)
Affected: a303bb0e58345fe9f7ab2f82b90266f2b5036058 , < 4daf06456677177f2a6044729abac59c1b49e87b (git)
Affected: a303bb0e58345fe9f7ab2f82b90266f2b5036058 , < d5650ddbd4d42c1a916c8fe1a4c4cb573ef810a1 (git)
Affected: a303bb0e58345fe9f7ab2f82b90266f2b5036058 , < 42bc06c67d94d5f2a6b33294b0c4b07d8a47c515 (git)
Affected: a303bb0e58345fe9f7ab2f82b90266f2b5036058 , < ebdf4b4f3b1474079980a2e5cd79ad65fb54db57 (git)
Affected: a303bb0e58345fe9f7ab2f82b90266f2b5036058 , < 590b07ceea138d49c9b64f65d263aa902d3b4730 (git)
Affected: a303bb0e58345fe9f7ab2f82b90266f2b5036058 , < e36663145abd7024f0281dfb22fdef65f185845b (git)
Affected: a303bb0e58345fe9f7ab2f82b90266f2b5036058 , < 9f00f9cf2be293efe899db67dc5272e3a9c62717 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.13
Unaffected: 0 , < 4.13 (semver)
Unaffected: 5.10.266 , ≤ 5.10.* (semver)
Unaffected: 5.15.217 , ≤ 5.15.* (semver)
Unaffected: 6.1.184 , ≤ 6.1.* (semver)
Unaffected: 6.6.153 , ≤ 6.6.* (semver)
Unaffected: 6.12.105 , ≤ 6.12.* (semver)
Unaffected: 6.18.46 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ceph/osdmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "66eec4af1e080b695229c9a20635648a6d12fedf",
              "status": "affected",
              "version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
              "versionType": "git"
            },
            {
              "lessThan": "4daf06456677177f2a6044729abac59c1b49e87b",
              "status": "affected",
              "version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
              "versionType": "git"
            },
            {
              "lessThan": "d5650ddbd4d42c1a916c8fe1a4c4cb573ef810a1",
              "status": "affected",
              "version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
              "versionType": "git"
            },
            {
              "lessThan": "42bc06c67d94d5f2a6b33294b0c4b07d8a47c515",
              "status": "affected",
              "version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
              "versionType": "git"
            },
            {
              "lessThan": "ebdf4b4f3b1474079980a2e5cd79ad65fb54db57",
              "status": "affected",
              "version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
              "versionType": "git"
            },
            {
              "lessThan": "590b07ceea138d49c9b64f65d263aa902d3b4730",
              "status": "affected",
              "version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
              "versionType": "git"
            },
            {
              "lessThan": "e36663145abd7024f0281dfb22fdef65f185845b",
              "status": "affected",
              "version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
              "versionType": "git"
            },
            {
              "lessThan": "9f00f9cf2be293efe899db67dc5272e3a9c62717",
              "status": "affected",
              "version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ceph/osdmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE\n\n__decode_pg_temp() decodes an user-controlled length but only rejects\nvalues large enough to overflow the allocation; it does not bound it to\nCEPH_PG_MAX_SIZE. The helper backs both pg_temp and pg_upmap decoding, and\napply_upmap()/get_temp_osds() later copy the decoded list into the fixed-size\non-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE]. A monitor that sends\nan OSDMap with a pg_temp/pg_upmap entry longer than 32 thus causes a stack\nout-of-bounds write.\n\nAn OSD set for a single PG can never exceed CEPH_PG_MAX_SIZE, so reject longer\nentries at decode time. The bound is well below the old overflow threshold, so\nit also covers the allocation-size overflow the previous check guarded against.\n\n  BUG: KASAN: stack-out-of-bounds in ceph_pg_to_up_acting_osds\n  Write of size 4 ... by task exploit\n   kasan_report (mm/kasan/report.c:595)\n   ceph_pg_to_up_acting_osds (net/ceph/osdmap.c:2617 net/ceph/osdmap.c:2833)\n   calc_target (net/ceph/osd_client.c:1638)\n   __submit_request (net/ceph/osd_client.c:2394)\n   ceph_osdc_start_request (net/ceph/osd_client.c:2490)\n   ceph_osdc_call (net/ceph/osd_client.c:5164)\n   rbd_dev_image_probe (drivers/block/rbd.c:6899)\n   do_rbd_add (drivers/block/rbd.c:7138)\n   ...\n  kernel BUG at net/ceph/osdmap.c:2670!\n\n[ idryomov: do the same in __decode_pg_upmap_items() ]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Malicious pg_temp/pg_upmap data arrives in CEPH_MSG_OSD_MAP from a Ceph monitor or OSD over TCP, is decoded in libceph, and later triggers stack corruption in ceph_pg_to_up_acting_osds during RBD/CephFS/libceph client I/O.\nAC:L - A compromised or attacker-controlled monitor can publish osdmap entries with length \u003e32 for chosen PGs; once the client subscribes, kernel I/O paths such as RBD mount/probe via calc_target deterministically invoke apply_upmap/get_temp_osds and overflow the stack buffer.\nPR:N - Exploitation requires no privileges on the victim host; any machine acting as a Ceph client that receives a forged osdmap from a cluster peer over the network can be attacked without local user capabilities or namespace tricks.\nUI:N - No victim user action is needed during exploitation beyond the host already being a Ceph client; forged osdmaps are applied automatically and the overflow fires on subsequent kernel client operations without interactive steps.\nS:U - Impact is confined to kernel memory on the Ceph client host (privilege escalation or crash); it does not cross VM, IOMMU, or sandbox boundaries to other security authorities.\nC:H - KASAN-confirmed stack out-of-bounds write in ceph_pg_to_up_acting_osds corrupts adjacent stack memory and can be leveraged for arbitrary kernel memory disclosure, not merely a bounded leak.\nI:H - Unbounded copy loops in apply_upmap() and get_temp_osds() write attacker-controlled u32 OSD IDs past the fixed osds[CEPH_PG_MAX_SIZE] stack array, enabling control-flow hijack and arbitrary kernel writes.\nA:H - The reported reproducer triggers KASAN stack-out-of-bounds followed by kernel BUG in ceph_pg_to_up_acting_osds, demonstrating a reliable kernel oops or panic from malformed osdmap processing on Ceph clients."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:46:00.131Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/66eec4af1e080b695229c9a20635648a6d12fedf"
        },
        {
          "url": "https://git.kernel.org/stable/c/4daf06456677177f2a6044729abac59c1b49e87b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5650ddbd4d42c1a916c8fe1a4c4cb573ef810a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/42bc06c67d94d5f2a6b33294b0c4b07d8a47c515"
        },
        {
          "url": "https://git.kernel.org/stable/c/ebdf4b4f3b1474079980a2e5cd79ad65fb54db57"
        },
        {
          "url": "https://git.kernel.org/stable/c/590b07ceea138d49c9b64f65d263aa902d3b4730"
        },
        {
          "url": "https://git.kernel.org/stable/c/e36663145abd7024f0281dfb22fdef65f185845b"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f00f9cf2be293efe899db67dc5272e3a9c62717"
        }
      ],
      "title": "libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68159",
    "datePublished": "2026-08-10T11:59:25.697Z",
    "dateReserved": "2026-07-30T09:28:09.371Z",
    "dateUpdated": "2026-08-23T12:46:00.131Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68159",
      "date": "2026-09-18",
      "epss": "0.00745",
      "percentile": "0.53248"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/ceph/osdmap.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "66eec4af1e080b695229c9a20635648a6d12fedf",
                    "status": "affected",
                    "version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4daf06456677177f2a6044729abac59c1b49e87b",
                    "status": "affected",
                    "version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d5650ddbd4d42c1a916c8fe1a4c4cb573ef810a1",
                    "status": "affected",
                    "version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "42bc06c67d94d5f2a6b33294b0c4b07d8a47c515",
                    "status": "affected",
                    "version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ebdf4b4f3b1474079980a2e5cd79ad65fb54db57",
                    "status": "affected",
                    "version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "590b07ceea138d49c9b64f65d263aa902d3b4730",
                    "status": "affected",
                    "version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e36663145abd7024f0281dfb22fdef65f185845b",
                    "status": "affected",
                    "version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9f00f9cf2be293efe899db67dc5272e3a9c62717",
                    "status": "affected",
                    "version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/ceph/osdmap.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.13"
                  },
                  {
                    "lessThan": "4.13",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.266",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.217",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.184",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.153",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.105",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.46",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE\n\n__decode_pg_temp() decodes an user-controlled length but only rejects\nvalues large enough to overflow the allocation; it does not bound it to\nCEPH_PG_MAX_SIZE. The helper backs both pg_temp and pg_upmap decoding, and\napply_upmap()/get_temp_osds() later copy the decoded list into the fixed-size\non-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE]. A monitor that sends\nan OSDMap with a pg_temp/pg_upmap entry longer than 32 thus causes a stack\nout-of-bounds write.\n\nAn OSD set for a single PG can never exceed CEPH_PG_MAX_SIZE, so reject longer\nentries at decode time. The bound is well below the old overflow threshold, so\nit also covers the allocation-size overflow the previous check guarded against.\n\n  BUG: KASAN: stack-out-of-bounds in ceph_pg_to_up_acting_osds\n  Write of size 4 ... by task exploit\n   kasan_report (mm/kasan/report.c:595)\n   ceph_pg_to_up_acting_osds (net/ceph/osdmap.c:2617 net/ceph/osdmap.c:2833)\n   calc_target (net/ceph/osd_client.c:1638)\n   __submit_request (net/ceph/osd_client.c:2394)\n   ceph_osdc_start_request (net/ceph/osd_client.c:2490)\n   ceph_osdc_call (net/ceph/osd_client.c:5164)\n   rbd_dev_image_probe (drivers/block/rbd.c:6899)\n   do_rbd_add (drivers/block/rbd.c:7138)\n   ...\n  kernel BUG at net/ceph/osdmap.c:2670!\n\n[ idryomov: do the same in __decode_pg_upmap_items() ]"
          }
        ],
        "id": "CVE-2026-68159",
        "lastModified": "2026-08-23T13:16:34.337",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-10T13:20:02.187",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/42bc06c67d94d5f2a6b33294b0c4b07d8a47c515"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4daf06456677177f2a6044729abac59c1b49e87b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/590b07ceea138d49c9b64f65d263aa902d3b4730"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/66eec4af1e080b695229c9a20635648a6d12fedf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9f00f9cf2be293efe899db67dc5272e3a9c62717"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d5650ddbd4d42c1a916c8fe1a4c4cb573ef810a1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e36663145abd7024f0281dfb22fdef65f185845b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ebdf4b4f3b1474079980a2e5cd79ad65fb54db57"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-17T14:43:09+00:00",
      "cve": "CVE-2026-68159",
      "id": "CVE-2026-68159",
      "initial_release_date": "2026-08-10T11:59:25.697000+00:00",
      "product_status:fixed": "303",
      "product_status:known_affected": "176",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68159.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-18T00:34:59Z",
      "cve": "CVE-2026-68159",
      "id": "CVE-2026-68159",
      "initial_release_date": "2026-08-18T16:56:04Z",
      "product_status:first_fixed": "127",
      "product_status:known_affected": "715",
      "product_status:known_not_affected": "4",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68159",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68159.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.