Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-68158

libceph: Fix multiplication overflow in decode_new_up_state_weight()

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 3.11, 3.13, 3.15, 3.17, 3.19, and 10 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: yes
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix multiplication overflow in decode_new_up_state_weight() If a message of type CEPH_MSG_OSD_MAP contains a (maliciously) corrupted osdmap, out-of-bounds memory accesses may occur in decode_new_up_state_weight(). This happens because the bounds check for the new_state part is based on calculating its length depending on a len value read from the incoming message. This calculation may overflow leading to an incorrect bounds check. Subsequently, out-of-bounds reads may occur when decoding this part. This patch switches the multiplication to use check_mul_overflow() to abort processing the osdmap if an overflow occurred. Therefore, osdmaps/messages containing large values for len that result in a multiplication overflow are treated as invalid. [ idryomov: rename new_state_len -> new_state_item_size, formatting ]

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: yes · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From 930c532869774ebf8af9efe9484c597f896a7d46 · fixed in 2ceee3b77b83052648c40fef965f836fd7699d26; From 930c532869774ebf8af9efe9484c597f896a7d46 · fixed in e4473751cc37db41f3f7da25d64a23e0c74570f1; From 930c532869774ebf8af9efe9484c597f896a7d46 · fixed in f6961070c326bd158c38fa48756cde2bd78c4aaa; From 930c532869774ebf8af9efe9484c597f896a7d46 · fixed in 05c90e059269f087becfcce23348496085835c29; From 930c532869774ebf8af9efe9484c597f896a7d46 · fixed in 143ba49ead77ec483c0326f8aaad8649874e99c4; From 930c532869774ebf8af9efe9484c597f896a7d46 · fixed in 1732d89dfcd74f6fde9ce70900d316c4a151c153; From 930c532869774ebf8af9efe9484c597f896a7d46 · fixed in bee4b5b53e7bff0467fd916cc44c9b190733c6bd; From 930c532869774ebf8af9efe9484c597f896a7d46 · fixed in 98917a499ec7064c14fc56d180a4fd636fc2784c; From 3.10.103 · fixed in 3.11; From 3.12.63 · fixed in 3.13; From 3.14.75 · fixed in 3.15; From 3.16.39 · fixed in 3.17; From 3.18.39 · fixed in 3.19; From 4.1.30 · fixed in 4.2; From 4.4.17 · fixed in 4.5; From 4.6.6 · fixed in 4.7

  • Linux Linux

    4.7

  • KernelLinux

    From 4.7.0 · fixed in 5.10.265; From 5.11.0 · fixed in 5.15.216; From 5.16.0 · fixed in 6.1.183; From 6.2.0 · fixed in 6.6.148; From 6.7.0 · fixed in 6.12.101; From 6.13.0 · fixed in 6.18.42; From 6.19.0 · fixed in 7.1.6

References 8

git.kernel.org