{"id":"CVE-2026-68157","title":"libceph: guard missing CRUSH type name lookup","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: guard missing CRUSH type name lookup\n\nLocalized read selection can walk a parent bucket whose name exists in\nthe CRUSH map while its type has no matching entry…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 117d96a04f007ce8fc2e292369056c3bd09f6f63 < cbfcba275326c8c7dae9acd8f4a0d4c316fdafb0","Linux >= 117d96a04f007ce8fc2e292369056c3bd09f6f63 < 8ff579ac03d6e9d17d6d9c8443110167c14a382d","Linux >= 117d96a04f007ce8fc2e292369056c3bd09f6f63 < 6a4b75d90f0cfbf22c14742ab35a803bc13f36ec","Linux >= 117d96a04f007ce8fc2e292369056c3bd09f6f63 < c46d82c47afc968d6ee8ef4470fa2dd35b765c21","Linux >= 117d96a04f007ce8fc2e292369056c3bd09f6f63 < 3767c9f0c1bbd98dd25cb088356a0fc6c1f09f50","Linux >= 117d96a04f007ce8fc2e292369056c3bd09f6f63 < 4716a64b7cc2797741f7be4e283ace78a9dff37d","Linux >= 117d96a04f007ce8fc2e292369056c3bd09f6f63 < db9cc9fd9660b2d69ee66f5a4cbec83c21a1c64d","Linux >= 117d96a04f007ce8fc2e292369056c3bd09f6f63 < bbeae12fda3384a90fbebc8a19ba9d33f85b5361","Linux 5.8"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-16T15:45:12.675517Z"},"published":"2026-08-10","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:53:01.207Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68157","references":[{"url":"https://git.kernel.org/stable/c/cbfcba275326c8c7dae9acd8f4a0d4c316fdafb0"},{"url":"https://git.kernel.org/stable/c/8ff579ac03d6e9d17d6d9c8443110167c14a382d"},{"url":"https://git.kernel.org/stable/c/6a4b75d90f0cfbf22c14742ab35a803bc13f36ec"},{"url":"https://git.kernel.org/stable/c/c46d82c47afc968d6ee8ef4470fa2dd35b765c21"},{"url":"https://git.kernel.org/stable/c/3767c9f0c1bbd98dd25cb088356a0fc6c1f09f50"},{"url":"https://git.kernel.org/stable/c/4716a64b7cc2797741f7be4e283ace78a9dff37d"},{"url":"https://git.kernel.org/stable/c/db9cc9fd9660b2d69ee66f5a4cbec83c21a1c64d"},{"url":"https://git.kernel.org/stable/c/bbeae12fda3384a90fbebc8a19ba9d33f85b5361"}],"tags":["cve.org"],"epss":0.00696,"epssPercentile":0.52051,"ingestedAt":"2026-10-16T17:24:46.849Z","slug":"CVE-2026-68157","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: guard missing CRUSH type name lookup\n\nLocalized read selection can walk a parent bucket whose name exists in\nthe CRUSH map while its type has no matching entry in type_names.\nget_immediate_parent() then dereferences a NULL type_cn and passes an\ninvalid pointer into strcmp(), causing a null-ptr-deref.\n\nSkip such malformed parent buckets unless both the bucket name and type\nname metadata are present. This keeps malformed hierarchy data from\ncrashing locality lookup and safely falls back to \"not local\".\n\n[ idryomov: add WARN_ON_ONCE ]\n\n## Affected\n\n- `Linux >= 117d96a04f007ce8fc2e292369056c3bd09f6f63 < cbfcba275326c8c7dae9acd8f4a0d4c316fdafb0`\n- `Linux >= 117d96a04f007ce8fc2e292369056c3bd09f6f63 < 8ff579ac03d6e9d17d6d9c8443110167c14a382d`\n- `Linux >= 117d96a04f007ce8fc2e292369056c3bd09f6f63 < 6a4b75d90f0cfbf22c14742ab35a803bc13f36ec`\n- `Linux >= 117d96a04f007ce8fc2e292369056c3bd09f6f63 < c46d82c47afc968d6ee8ef4470fa2dd35b765c21`\n- `Linux >= 117d96a04f007ce8fc2e292369056c3bd09f6f63 < 3767c9f0c1bbd98dd25cb088356a0fc6c1f09f50`\n- `Linux >= 117d96a04f007ce8fc2e292369056c3bd09f6f63 < 4716a64b7cc2797741f7be4e283ace78a9dff37d`\n- `Linux >= 117d96a04f007ce8fc2e292369056c3bd09f6f63 < db9cc9fd9660b2d69ee66f5a4cbec83c21a1c64d`\n- `Linux >= 117d96a04f007ce8fc2e292369056c3bd09f6f63 < bbeae12fda3384a90fbebc8a19ba9d33f85b5361`\n- `Linux 5.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}