CVE-2026-68433 (GCVE-0-2026-68433)
Vulnerability from cvelistv5 – Published: 2026-08-12 00:07 – Updated: 2026-10-16 15:53
VLAI
EPSS
VEX
Title
libceph: bound get_version reply decode to front len
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: bound get_version reply decode to front len
handle_get_version_reply() uses msg->front_alloc_len as the decode
boundary for MON_GET_VERSION_REPLY. That is the size of the reused
reply buffer, not the number of bytes actually received.
A truncated reply can therefore pass ceph_decode_need() and decode the
second u64 from stale tail bytes left in the buffer by an earlier
message, causing an uninitialized memory read.
Use msg->front.iov_len as the receive-side decode boundary, matching
other libceph reply handlers and limiting decoding to the bytes that
were actually read from the wire.
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 15:48 UTC
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
513a8243d67f8e8d27f2883bd2f18bc87c7ca376 , < 1307028f082756bf453e1889aee9983d30643a4b
(git)
Affected: 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 , < f6cbf6878f3a1503c872ba8f1e69a58ee68d8b2e (git) Affected: 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 , < 72a35070fcefa229b1b031aa7482ad3788e18f07 (git) Affected: 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 , < 340e0386aa39da181015bee38f309018c335ce16 (git) Affected: 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 , < d60de8253c85a02d0e6194b0735e7a562981a04c (git) Affected: 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 , < 4e7ebfaa0d14cf50e44041bfde38070d6dbc019f (git) Affected: 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 , < 0d934c934ec746d53fc7e4f53239792647bbae63 (git) Affected: 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 , < d3c32939fa0e3ee9b883b9a0fd1972c5c444e3d0 (git) |
guessed | |
| Linux | Linux |
Affected:
3.16
Unaffected: 0 , < 3.16 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68433",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:48:55.526707Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T15:53:13.520Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/mon_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1307028f082756bf453e1889aee9983d30643a4b",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
},
{
"lessThan": "f6cbf6878f3a1503c872ba8f1e69a58ee68d8b2e",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
},
{
"lessThan": "72a35070fcefa229b1b031aa7482ad3788e18f07",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
},
{
"lessThan": "340e0386aa39da181015bee38f309018c335ce16",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
},
{
"lessThan": "d60de8253c85a02d0e6194b0735e7a562981a04c",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
},
{
"lessThan": "4e7ebfaa0d14cf50e44041bfde38070d6dbc019f",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
},
{
"lessThan": "0d934c934ec746d53fc7e4f53239792647bbae63",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
},
{
"lessThan": "d3c32939fa0e3ee9b883b9a0fd1972c5c444e3d0",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/mon_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.16"
},
{
"lessThan": "3.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: bound get_version reply decode to front len\n\nhandle_get_version_reply() uses msg-\u003efront_alloc_len as the decode\nboundary for MON_GET_VERSION_REPLY. That is the size of the reused\nreply buffer, not the number of bytes actually received.\n\nA truncated reply can therefore pass ceph_decode_need() and decode the\nsecond u64 from stale tail bytes left in the buffer by an earlier\nmessage, causing an uninitialized memory read.\n\nUse msg-\u003efront.iov_len as the receive-side decode boundary, matching\nother libceph reply handlers and limiting decoding to the bytes that\nwere actually read from the wire."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The malformed MON_GET_VERSION_REPLY arrives over the ceph messenger TCP connection to a monitor; a malicious/compromised ceph-mon or an on-path attacker on the msgr1/crc-mode session triggers the bug purely with received network data.\nAC:L - The attacker fully controls the reply\u0027s hdr.front_len and tid, so truncating the reply to 8 bytes reliably makes the handler decode past the received data every time; no race or memory-layout condition outside attacker control is involved.\nPR:N - The vulnerable decode runs on any reply the client accepts for an outstanding generic request; the attacker acts as the remote server/peer and needs no credentials or account on the victim kernel client.\nUI:N - An already-mounted CephFS/RBD client issues mon_get_version requests automatically (osdmap checks, pool-dne checks, remount/latest-map waits), so no local user action is needed once the client is connected.\nS:U - The uninitialized read and the resulting bogus epoch stay within the kernel\u0027s own libceph client state; no security authority other than the affected kernel is impacted.\nC:L - Eight bytes of uninitialized kvmalloc\u0027d heap (or stale bytes of a prior reply) are consumed as req-\u003eu.newest; the read stays inside the 32-byte allocation and is not copied to userspace, so it is a small bounded uninitialized-memory disclosure that only leaks indirectly through client behaviour.\nI:L - The attacker causes kernel state (req-\u003eu.newest, r_map_dne_bound, linger map_dne_bound) to be populated from uninitialized memory rather than the wire, corrupting osdmap-epoch bookkeeping and leading to wrong pool-does-not-exist decisions, but gives no arbitrary write.\nA:H - A zero stale value trips WARN_ON(greq-\u003eresult || !greq-\u003eu.newest) in map_check_cb()/linger_map_check_cb() (panic with panic_on_warn), while a huge garbage epoch makes ceph_monc_wait_osdmap() block until mount_timeout or indefinitely and makes check_pool_dne() abort in-flight requests with -ENOENT; all repeatable at will."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:35:33.508Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1307028f082756bf453e1889aee9983d30643a4b"
},
{
"url": "https://git.kernel.org/stable/c/f6cbf6878f3a1503c872ba8f1e69a58ee68d8b2e"
},
{
"url": "https://git.kernel.org/stable/c/72a35070fcefa229b1b031aa7482ad3788e18f07"
},
{
"url": "https://git.kernel.org/stable/c/340e0386aa39da181015bee38f309018c335ce16"
},
{
"url": "https://git.kernel.org/stable/c/d60de8253c85a02d0e6194b0735e7a562981a04c"
},
{
"url": "https://git.kernel.org/stable/c/4e7ebfaa0d14cf50e44041bfde38070d6dbc019f"
},
{
"url": "https://git.kernel.org/stable/c/0d934c934ec746d53fc7e4f53239792647bbae63"
},
{
"url": "https://git.kernel.org/stable/c/d3c32939fa0e3ee9b883b9a0fd1972c5c444e3d0"
}
],
"title": "libceph: bound get_version reply decode to front len",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68433",
"datePublished": "2026-08-12T00:07:20.455Z",
"dateReserved": "2026-07-30T09:28:09.393Z",
"dateUpdated": "2026-10-16T15:53:13.520Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-68433",
"date": "2026-10-17",
"epss": "0.00291",
"percentile": "0.2026"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/mon_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1307028f082756bf453e1889aee9983d30643a4b",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
},
{
"lessThan": "f6cbf6878f3a1503c872ba8f1e69a58ee68d8b2e",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
},
{
"lessThan": "72a35070fcefa229b1b031aa7482ad3788e18f07",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
},
{
"lessThan": "340e0386aa39da181015bee38f309018c335ce16",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
},
{
"lessThan": "d60de8253c85a02d0e6194b0735e7a562981a04c",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
},
{
"lessThan": "4e7ebfaa0d14cf50e44041bfde38070d6dbc019f",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
},
{
"lessThan": "0d934c934ec746d53fc7e4f53239792647bbae63",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
},
{
"lessThan": "d3c32939fa0e3ee9b883b9a0fd1972c5c444e3d0",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/mon_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.16"
},
{
"lessThan": "3.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: bound get_version reply decode to front len\n\nhandle_get_version_reply() uses msg-\u003efront_alloc_len as the decode\nboundary for MON_GET_VERSION_REPLY. That is the size of the reused\nreply buffer, not the number of bytes actually received.\n\nA truncated reply can therefore pass ceph_decode_need() and decode the\nsecond u64 from stale tail bytes left in the buffer by an earlier\nmessage, causing an uninitialized memory read.\n\nUse msg-\u003efront.iov_len as the receive-side decode boundary, matching\nother libceph reply handlers and limiting decoding to the bytes that\nwere actually read from the wire."
}
],
"id": "CVE-2026-68433",
"lastModified": "2026-10-16T16:19:58.073",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 4.7,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-68433",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:48:55.526707Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-12T00:17:43.403",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/0d934c934ec746d53fc7e4f53239792647bbae63"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/1307028f082756bf453e1889aee9983d30643a4b"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/340e0386aa39da181015bee38f309018c335ce16"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/4e7ebfaa0d14cf50e44041bfde38070d6dbc019f"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/72a35070fcefa229b1b031aa7482ad3788e18f07"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/d3c32939fa0e3ee9b883b9a0fd1972c5c444e3d0"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/d60de8253c85a02d0e6194b0735e7a562981a04c"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/f6cbf6878f3a1503c872ba8f1e69a58ee68d8b2e"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-31T11:27:54+00:00",
"cve": "CVE-2026-68433",
"id": "CVE-2026-68433",
"initial_release_date": "2026-08-12T00:00:00+00:00",
"product_status:known_affected": "261",
"product_status:known_not_affected": "16",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: libceph: bound get_version reply decode to front len",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68433.json",
"version": "3"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.