libceph: reject zero bucket types in crush_decode

Summary

In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crush_decode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crush_decode() accepts a bucket with type 0, a malformed CRUSH map can make the mapper treat a negative bucket ID as a device and pass it to is_out(), which then indexes the OSD weight array with a negative value. Reject zero bucket types while decoding the CRUSH map so the invalid state never reaches the mapper.

Timeline

1. Aug 10, 2026, 11:59 AM UTCCVE published
2. Oct 16, 2026, 3:45 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: total

3. Oct 19, 2026, 8:58 PM UTCRecord last updated

Affected versions

• Linux Linux

  From f24e9980eb860d8600cbe5ef3d2fd9295320d229 · fixed in 952ca5dc99913d169263f59fd689f586729a13c1; From f24e9980eb860d8600cbe5ef3d2fd9295320d229 · fixed in 146461f09565afe3665e65b0423d3d6b0fe806c5; From f24e9980eb860d8600cbe5ef3d2fd9295320d229 · fixed in 80fc40e11cda1b5d990a3f69c6efa344fb5cd987; From f24e9980eb860d8600cbe5ef3d2fd9295320d229 · fixed in b8a9fb6bf806f9c4891e71ae1beab0c07c23a877; From f24e9980eb860d8600cbe5ef3d2fd9295320d229 · fixed in 826cd1de5802fd392922785f9b64d76e65d2a100; From f24e9980eb860d8600cbe5ef3d2fd9295320d229 · fixed in 3b2f1937f5fce8b7dd5432e7693e3cc8b5eece56; From f24e9980eb860d8600cbe5ef3d2fd9295320d229 · fixed in 70998f91030ee083ecb336a1dff0701c20a38081; From f24e9980eb860d8600cbe5ef3d2fd9295320d229 · fixed in 05f90284223381005d6bcddab3fda4a97f9c3401

• Linux Linux

  2.6.34

• KernelLinux

  From 2.6.34 · fixed in 5.10.265; From 5.11.0 · fixed in 5.15.216; From 5.16.0 · fixed in 6.1.183; From 6.2.0 · fixed in 6.6.148; From 6.7.0 · fixed in 6.12.101; From 6.13.0 · fixed in 6.18.42; From 6.19.0 · fixed in 7.1.6

References 8