GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-68155 (GCVE-0-2026-68155)

Vulnerability from cvelistv5 – Published: 2026-08-10 11:59 – Updated: 2026-08-19 16:30
VLAI
Title
libceph: Reject monmaps advertising zero monitors
Summary
In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPH_MSG_MON_MAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the existing monitors in the cluster. Currently, a monmap indicating that there are zero monitors in the cluster is treated as valid. However, it is impossible to have zero monitors in the cluster and still receive a valid monmap from a monitor. Therefore, such a monmap must be corrupted and should be treated as invalid. Furthermore, a monmap with a monitor count of zero can subsequently crash the client when attempting to open a session with a monitor in __open_session(). This happens because the "BUG_ON(monc->monmap->num_mon < 1)" assertion in pick_new_mon() is triggered. This patch extends a check in ceph_monmap_decode() to also reject arriving mon_maps with num_mon == 0 rather than only with num_mon > CEPH_MAX_MON. [ idryomov: drop "log output for unusual values of num_mon" part ]
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ba75bb98cfb93b62c54af25bf67ff90857264bbe , < caf082ef8609a6ac26159ce115f55ab7d00231a3 (git)
Affected: ba75bb98cfb93b62c54af25bf67ff90857264bbe , < e3ccd4ecab09b22f507f49cb7ed9990c7158ceab (git)
Affected: ba75bb98cfb93b62c54af25bf67ff90857264bbe , < 0591a15815b498be628a937146e44487d599ba33 (git)
Affected: ba75bb98cfb93b62c54af25bf67ff90857264bbe , < cd0d41bc569632eaaeccde9d2a6bc919ec00c407 (git)
Affected: ba75bb98cfb93b62c54af25bf67ff90857264bbe , < e67e8b694872c9bc66996040f9de9242f6236ed9 (git)
Affected: ba75bb98cfb93b62c54af25bf67ff90857264bbe , < 3b249546f59c3d6d3592c10657f82bc3f1faa07c (git)
Affected: ba75bb98cfb93b62c54af25bf67ff90857264bbe , < 40480eee361ed9676b3f844d532ac28b47251634 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.34
Unaffected: 0 , < 2.6.34 (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ceph/mon_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "caf082ef8609a6ac26159ce115f55ab7d00231a3",
              "status": "affected",
              "version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
              "versionType": "git"
            },
            {
              "lessThan": "e3ccd4ecab09b22f507f49cb7ed9990c7158ceab",
              "status": "affected",
              "version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
              "versionType": "git"
            },
            {
              "lessThan": "0591a15815b498be628a937146e44487d599ba33",
              "status": "affected",
              "version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
              "versionType": "git"
            },
            {
              "lessThan": "cd0d41bc569632eaaeccde9d2a6bc919ec00c407",
              "status": "affected",
              "version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
              "versionType": "git"
            },
            {
              "lessThan": "e67e8b694872c9bc66996040f9de9242f6236ed9",
              "status": "affected",
              "version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
              "versionType": "git"
            },
            {
              "lessThan": "3b249546f59c3d6d3592c10657f82bc3f1faa07c",
              "status": "affected",
              "version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
              "versionType": "git"
            },
            {
              "lessThan": "40480eee361ed9676b3f844d532ac28b47251634",
              "status": "affected",
              "version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ceph/mon_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.34"
            },
            {
              "lessThan": "2.6.34",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Reject monmaps advertising zero monitors\n\nA message of type CEPH_MSG_MON_MAP contains a monmap that is sent from a\nmonitor to the client. This monmap contains information about the\nexisting monitors in the cluster. Currently, a monmap indicating that\nthere are zero monitors in the cluster is treated as valid. However, it\nis impossible to have zero monitors in the cluster and still receive a\nvalid monmap from a monitor. Therefore, such a monmap must be corrupted\nand should be treated as invalid. Furthermore, a monmap with a monitor\ncount of zero can subsequently crash the client when attempting to open\na session with a monitor in __open_session(). This happens because the\n\"BUG_ON(monc-\u003emonmap-\u003enum_mon \u003c 1)\" assertion in pick_new_mon() is\ntriggered.\n\nThis patch extends a check in ceph_monmap_decode() to also reject\narriving mon_maps with num_mon == 0 rather than only with\nnum_mon \u003e CEPH_MAX_MON.\n\n[ idryomov: drop \"log output for unusual values of num_mon\" part ]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reached when libceph decodes CEPH_MSG_MON_MAP from a remote Ceph monitor over the kernel client\u0027s established TCP/msgr2 session (mon_dispatch -\u003e ceph_monc_handle_map -\u003e ceph_monmap_decode), which is a network protocol attack surface on CephFS/RBD/cloud nodes.\nAC:L - An attacker who can send monitor protocol messages only needs to set num_mon=0 in the monmap; once accepted, any later session reopen (keepalive timeout, hunt, or connection fault) deterministically hits BUG_ON in pick_new_mon without races or special memory layout.\nPR:N - In the highest-impact scenario a malicious or compromised Ceph monitor (or equivalent authenticated cluster peer) sends the malformed monmap to already-connected kernel clients; the attacker needs no local privileges on the victim host.\nUI:N - After a Ceph client session exists, monmap updates are delivered and processed automatically by the kernel monitor client; no further mount, open, or other victim interaction is required to accept the bad map and later crash on reconnect.\nS:U - Exploitation causes a kernel BUG/panic within the same kernel security domain and does not cross VM, container, IOMMU, or other security boundaries.\nC:N - The failure mode is a BUG_ON assertion in pick_new_mon when num_mon is zero; there is no memory corruption, out-of-bounds access, or other information disclosure primitive on the vulnerable path.\nI:N - Accepting num_mon==0 only stores an empty monmap and later triggers a deliberate kernel BUG; attacker input does not corrupt or modify arbitrary kernel memory or enable code execution.\nA:H - BUG_ON(monc-\u003emonmap-\u003enum_mon \u003c 1) in pick_new_mon during __open_session causes a kernel oops/panic, fully denying availability of the affected host until reboot."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:30:22.933Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/caf082ef8609a6ac26159ce115f55ab7d00231a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3ccd4ecab09b22f507f49cb7ed9990c7158ceab"
        },
        {
          "url": "https://git.kernel.org/stable/c/0591a15815b498be628a937146e44487d599ba33"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd0d41bc569632eaaeccde9d2a6bc919ec00c407"
        },
        {
          "url": "https://git.kernel.org/stable/c/e67e8b694872c9bc66996040f9de9242f6236ed9"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b249546f59c3d6d3592c10657f82bc3f1faa07c"
        },
        {
          "url": "https://git.kernel.org/stable/c/40480eee361ed9676b3f844d532ac28b47251634"
        }
      ],
      "title": "libceph: Reject monmaps advertising zero monitors",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68155",
    "datePublished": "2026-08-10T11:59:21.200Z",
    "dateReserved": "2026-07-30T09:28:09.371Z",
    "dateUpdated": "2026-08-19T16:30:22.933Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68155",
      "date": "2026-09-19",
      "epss": "0.00662",
      "percentile": "0.50207"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/ceph/mon_client.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "caf082ef8609a6ac26159ce115f55ab7d00231a3",
                    "status": "affected",
                    "version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e3ccd4ecab09b22f507f49cb7ed9990c7158ceab",
                    "status": "affected",
                    "version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0591a15815b498be628a937146e44487d599ba33",
                    "status": "affected",
                    "version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cd0d41bc569632eaaeccde9d2a6bc919ec00c407",
                    "status": "affected",
                    "version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e67e8b694872c9bc66996040f9de9242f6236ed9",
                    "status": "affected",
                    "version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3b249546f59c3d6d3592c10657f82bc3f1faa07c",
                    "status": "affected",
                    "version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "40480eee361ed9676b3f844d532ac28b47251634",
                    "status": "affected",
                    "version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/ceph/mon_client.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.34"
                  },
                  {
                    "lessThan": "2.6.34",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.216",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.148",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.101",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Reject monmaps advertising zero monitors\n\nA message of type CEPH_MSG_MON_MAP contains a monmap that is sent from a\nmonitor to the client. This monmap contains information about the\nexisting monitors in the cluster. Currently, a monmap indicating that\nthere are zero monitors in the cluster is treated as valid. However, it\nis impossible to have zero monitors in the cluster and still receive a\nvalid monmap from a monitor. Therefore, such a monmap must be corrupted\nand should be treated as invalid. Furthermore, a monmap with a monitor\ncount of zero can subsequently crash the client when attempting to open\na session with a monitor in __open_session(). This happens because the\n\"BUG_ON(monc-\u003emonmap-\u003enum_mon \u003c 1)\" assertion in pick_new_mon() is\ntriggered.\n\nThis patch extends a check in ceph_monmap_decode() to also reject\narriving mon_maps with num_mon == 0 rather than only with\nnum_mon \u003e CEPH_MAX_MON.\n\n[ idryomov: drop \"log output for unusual values of num_mon\" part ]"
          }
        ],
        "id": "CVE-2026-68155",
        "lastModified": "2026-08-19T17:20:32.680",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-10T13:20:01.657",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0591a15815b498be628a937146e44487d599ba33"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3b249546f59c3d6d3592c10657f82bc3f1faa07c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/40480eee361ed9676b3f844d532ac28b47251634"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/caf082ef8609a6ac26159ce115f55ab7d00231a3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cd0d41bc569632eaaeccde9d2a6bc919ec00c407"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e3ccd4ecab09b22f507f49cb7ed9990c7158ceab"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e67e8b694872c9bc66996040f9de9242f6236ed9"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-26T13:35:59+00:00",
      "cve": "CVE-2026-68155",
      "id": "CVE-2026-68155",
      "initial_release_date": "2026-08-10T11:59:21.200000+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "16",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68155.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-18T00:35:05Z",
      "cve": "CVE-2026-68155",
      "id": "CVE-2026-68155",
      "initial_release_date": "2026-08-18T00:08:30Z",
      "product_status:first_fixed": "127",
      "product_status:known_affected": "438",
      "product_status:known_not_affected": "281",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68155",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68155.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.