---
id: CVE-2026-68158
title: 'libceph: Fix multiplication overflow in decode_new_up_state_weight()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  libceph: Fix multiplication overflow in decode_new_up_state_weight()

  If a message of type CEPH_MSG_OSD_MAP contains a (maliciously) corrupted
  osdmap, out-of-bounds mem…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 930c532869774ebf8af9efe9484c597f896a7d46 <
    2ceee3b77b83052648c40fef965f836fd7699d26
  - >-
    Linux >= 930c532869774ebf8af9efe9484c597f896a7d46 <
    e4473751cc37db41f3f7da25d64a23e0c74570f1
  - >-
    Linux >= 930c532869774ebf8af9efe9484c597f896a7d46 <
    f6961070c326bd158c38fa48756cde2bd78c4aaa
  - >-
    Linux >= 930c532869774ebf8af9efe9484c597f896a7d46 <
    05c90e059269f087becfcce23348496085835c29
  - >-
    Linux >= 930c532869774ebf8af9efe9484c597f896a7d46 <
    143ba49ead77ec483c0326f8aaad8649874e99c4
  - >-
    Linux >= 930c532869774ebf8af9efe9484c597f896a7d46 <
    1732d89dfcd74f6fde9ce70900d316c4a151c153
  - >-
    Linux >= 930c532869774ebf8af9efe9484c597f896a7d46 <
    bee4b5b53e7bff0467fd916cc44c9b190733c6bd
  - >-
    Linux >= 930c532869774ebf8af9efe9484c597f896a7d46 <
    98917a499ec7064c14fc56d180a4fd636fc2784c
  - Linux 1196c36fd53c3b1615eb02f986cb727b1dfc1047
  - Linux bbc3aa6b0e6050b2b2e04a08dd4d6423d576b196
  - Linux 6b96b2d473701b45df3fea8dd9796b6ec39e6d54
  - Linux 7405d73cea0d0e6c541f5c534078feeb46188844
  - Linux 8777c9f654637d56f4c4ca54eb1bc7c609b70085
  - Linux 6831c98ce0b8a3e88db64aa224372effd0dcc694
  - Linux 032951d32c13b7564dfba82758260cb7aa1149d2
  - Linux 14877928f10667a5606383885d004f7185f33718
  - Linux >= 3.10.103 < 3.11
  - Linux >= 3.12.63 < 3.13
  - Linux >= 3.14.75 < 3.15
  - Linux >= 3.16.39 < 3.17
  - Linux >= 3.18.39 < 3.19
  - Linux >= 4.1.30 < 4.2
  - Linux >= 4.4.17 < 4.5
  - Linux >= 4.6.6 < 4.7
  - Linux 4.7
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T15:45:15.268376Z'
published: '2026-08-10'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:01.360Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68158'
references:
  - url: 'https://git.kernel.org/stable/c/2ceee3b77b83052648c40fef965f836fd7699d26'
  - url: 'https://git.kernel.org/stable/c/e4473751cc37db41f3f7da25d64a23e0c74570f1'
  - url: 'https://git.kernel.org/stable/c/f6961070c326bd158c38fa48756cde2bd78c4aaa'
  - url: 'https://git.kernel.org/stable/c/05c90e059269f087becfcce23348496085835c29'
  - url: 'https://git.kernel.org/stable/c/143ba49ead77ec483c0326f8aaad8649874e99c4'
  - url: 'https://git.kernel.org/stable/c/1732d89dfcd74f6fde9ce70900d316c4a151c153'
  - url: 'https://git.kernel.org/stable/c/bee4b5b53e7bff0467fd916cc44c9b190733c6bd'
  - url: 'https://git.kernel.org/stable/c/98917a499ec7064c14fc56d180a4fd636fc2784c'
tags:
  - cve.org
epss: 0.00714
epssPercentile: 0.52735
ingestedAt: '2026-10-16T17:24:46.849Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

libceph: Fix multiplication overflow in decode_new_up_state_weight()

If a message of type CEPH_MSG_OSD_MAP contains a (maliciously) corrupted
osdmap, out-of-bounds memory accesses may occur in
decode_new_up_state_weight(). This happens because the bounds check for
the new_state part is based on calculating its length depending on a len
value read from the incoming message. This calculation may overflow
leading to an incorrect bounds check. Subsequently, out-of-bounds reads
may occur when decoding this part.

This patch switches the multiplication to use check_mul_overflow() to
abort processing the osdmap if an overflow occurred. Therefore,
osdmaps/messages containing large values for len that result in a
multiplication overflow are treated as invalid.

[ idryomov: rename new_state_len -> new_state_item_size, formatting ]

## Affected

- `Linux >= 930c532869774ebf8af9efe9484c597f896a7d46 < 2ceee3b77b83052648c40fef965f836fd7699d26`
- `Linux >= 930c532869774ebf8af9efe9484c597f896a7d46 < e4473751cc37db41f3f7da25d64a23e0c74570f1`
- `Linux >= 930c532869774ebf8af9efe9484c597f896a7d46 < f6961070c326bd158c38fa48756cde2bd78c4aaa`
- `Linux >= 930c532869774ebf8af9efe9484c597f896a7d46 < 05c90e059269f087becfcce23348496085835c29`
- `Linux >= 930c532869774ebf8af9efe9484c597f896a7d46 < 143ba49ead77ec483c0326f8aaad8649874e99c4`
- `Linux >= 930c532869774ebf8af9efe9484c597f896a7d46 < 1732d89dfcd74f6fde9ce70900d316c4a151c153`
- `Linux >= 930c532869774ebf8af9efe9484c597f896a7d46 < bee4b5b53e7bff0467fd916cc44c9b190733c6bd`
- `Linux >= 930c532869774ebf8af9efe9484c597f896a7d46 < 98917a499ec7064c14fc56d180a4fd636fc2784c`
- `Linux 1196c36fd53c3b1615eb02f986cb727b1dfc1047`
- `Linux bbc3aa6b0e6050b2b2e04a08dd4d6423d576b196`
- `Linux 6b96b2d473701b45df3fea8dd9796b6ec39e6d54`
- `Linux 7405d73cea0d0e6c541f5c534078feeb46188844`
- `Linux 8777c9f654637d56f4c4ca54eb1bc7c609b70085`
- `Linux 6831c98ce0b8a3e88db64aa224372effd0dcc694`
- `Linux 032951d32c13b7564dfba82758260cb7aa1149d2`
- `Linux 14877928f10667a5606383885d004f7185f33718`
- `Linux >= 3.10.103 < 3.11`
- `Linux >= 3.12.63 < 3.13`
- `Linux >= 3.14.75 < 3.15`
- `Linux >= 3.16.39 < 3.17`
- `Linux >= 3.18.39 < 3.19`
- `Linux >= 4.1.30 < 4.2`
- `Linux >= 4.4.17 < 4.5`
- `Linux >= 4.6.6 < 4.7`
- `Linux 4.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.