CVE-2026-68158Critical· 9.8▾ MidnightIn the Linux kernel, the following vulnerability has been resolved: libceph: Fix multiplication overflow in decode_new_up_state_weight() If a message of type CEPH_MSG_OSD_MAP contains a (maliciously) corrupted osdmap, out-of-bounds mem…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.7%
Last analysed / modified upstream
In the Linux kernel, the following vulnerability has been resolved:
libceph: Fix multiplication overflow in decode_new_up_state_weight()
If a message of type CEPH_MSG_OSD_MAP contains a (maliciously) corrupted osdmap, out-of-bounds memory accesses may occur in decode_new_up_state_weight(). This happens because the bounds check for the new_state part is based on calculating its length depending on a len value read from the incoming message. This calculation may overflow leading to an incorrect bounds check. Subsequently, out-of-bounds reads may occur when decoding this part.
This patch switches the multiplication to use check_mul_overflow() to abort processing the osdmap if an overflow occurred. Therefore, osdmaps/messages containing large values for len that result in a multiplication overflow are treated as invalid.
[ idryomov: rename new_state_len -> new_state_item_size, formatting ]
Linux >= 930c532869774ebf8af9efe9484c597f896a7d46 < 2ceee3b77b83052648c40fef965f836fd7699d26Linux >= 930c532869774ebf8af9efe9484c597f896a7d46 < e4473751cc37db41f3f7da25d64a23e0c74570f1Linux >= 930c532869774ebf8af9efe9484c597f896a7d46 < f6961070c326bd158c38fa48756cde2bd78c4aaaLinux >= 930c532869774ebf8af9efe9484c597f896a7d46 < 05c90e059269f087becfcce23348496085835c29Linux >= 930c532869774ebf8af9efe9484c597f896a7d46 < 143ba49ead77ec483c0326f8aaad8649874e99c4Linux >= 930c532869774ebf8af9efe9484c597f896a7d46 < 1732d89dfcd74f6fde9ce70900d316c4a151c153Linux >= 930c532869774ebf8af9efe9484c597f896a7d46 < bee4b5b53e7bff0467fd916cc44c9b190733c6bdLinux >= 930c532869774ebf8af9efe9484c597f896a7d46 < 98917a499ec7064c14fc56d180a4fd636fc2784cLinux 1196c36fd53c3b1615eb02f986cb727b1dfc1047Linux bbc3aa6b0e6050b2b2e04a08dd4d6423d576b196Linux 6b96b2d473701b45df3fea8dd9796b6ec39e6d54Linux 7405d73cea0d0e6c541f5c534078feeb46188844Linux 8777c9f654637d56f4c4ca54eb1bc7c609b70085Linux 6831c98ce0b8a3e88db64aa224372effd0dcc694Linux 032951d32c13b7564dfba82758260cb7aa1149d2Linux 14877928f10667a5606383885d004f7185f33718Linux >= 3.10.103 < 3.11Linux >= 3.12.63 < 3.13Linux >= 3.14.75 < 3.15Linux >= 3.16.39 < 3.17Linux >= 3.18.39 < 3.19Linux >= 4.1.30 < 4.2Linux >= 4.4.17 < 4.5Linux >= 4.6.6 < 4.7Linux 4.7Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99118Nonedrm/i915/dmc: Harden DMC firmware payload parsing
CVE-2026-99117Nonenet: bridge: mcast: don't truncate the port group walk on teardown
CVE-2026-99121Noneipv4: avoid divide by zero in fib_rebalance
CVE-2026-99120NoneKVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes
CVE-2026-99119Nonedrm/amdgpu/userq: actually validate userq BOs
CVE-2026-99123Nonevsock/virtio: validate packet source for connected sockets