External risk intelligence

Linux Kernel libceph CRUSH Map Parsing Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-68154

This vulnerability exists within the Linux kernel's Ceph filesystem component, specifically during the processing of CRUSH maps. While network-reachable in some environments, Ceph cluster infrastructure and CRUSH map management are typically restricted to internal storage networks, making direct public internet exposure uncommon and contrary to standard deployment practices.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Linux kernel's Ceph component could allow an attacker to manipulate data storage mappings. This issue arises from how the system processes specific data structures, potentially leading to unintended data access or modification by treating certain data as device identifiers. The primary concern is verifying if this specific component is in use and exposed.

Allows manipulation of storage data mappings.
Matters if using specific Linux kernel storage.
Confirm relevance and exposure of affected component.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by submitting a specially crafted CRUSH map to a system running a vulnerable Linux kernel. The kernel's CRUSH decoding function incorrectly accepts a zero bucket type, which is meant for devices, leading to a negative index into an array. This could allow an attacker to manipulate system data and potentially compromise the entire system.

Network access required.
Malformed CRUSH map triggers vulnerability.
Potential for data corruption and system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's Ceph component could allow an attacker to manipulate the CRUSH map. When the system processes a malformed CRUSH map, it may incorrectly treat a negative bucket ID as a device, leading to a negative array index. This could potentially affect the integrity of the storage system's data mapping.

Storage system's data mapping.
Malformed CRUSH map processing.
Data mapping integrity may be affected.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's Ceph component requires immediate attention from infrastructure and platform teams responsible for storage systems. The first practical step is to identify all instances of the affected Linux kernel, determine their exposure to the network, and assess their criticality to business operations. Once identified, the accountable owner should be located to plan and execute the necessary remediation.

Infrastructure or Platform Teams own the issue.
Verify Ceph system reachability and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel libceph component?

Libceph is a library within the Linux kernel that provides the core functionality for communicating with Ceph, a distributed storage system. It is responsible for tasks like parsing CRUSH maps, which define how data is distributed and replicated across storage clusters. Systems using this component are typically large-scale storage environments where data redundancy and efficient mapping across multiple physical servers are required.

What does CVE-2026-68154 mean for system stability?

This vulnerability is an input validation error. The system incorrectly accepts a reserved 'zero' bucket type during the processing of a CRUSH map. By design, bucket type 0 is strictly for leaf devices. Accepting this value allows an attacker to trick the system into treating an invalid ID as a device, which causes the software to reference memory outside of its intended boundaries. This logical flaw can lead to system-wide data mapping corruption.

How is this vulnerability triggered?

The flaw is triggered when the kernel decodes a malformed CRUSH map that includes a zero-type bucket. The trigger path requires the ability to submit or influence these map structures, which are used to define storage topology. Simply running the Linux kernel or having Ceph installed does not trigger the bug; the system must specifically process a maliciously crafted input that violates the expected storage architecture rules.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal identifies this risk as 'Unlikely' for most environments. Because libceph operates deep within storage infrastructure and CRUSH map management is usually confined to internal, protected storage networks, it is rarely reachable from the public internet. If your Ceph clusters are isolated from external traffic, the likelihood of an attacker reaching this code path is significantly reduced.

Do I need to patch my servers immediately?

You should begin by identifying which systems in your environment are running the affected Linux kernel with Ceph enabled. Once you have a list, prioritize those that are most critical to your business operations. Since the vulnerability requires specific network interactions with the storage layer, verify the network placement of these clusters. Coordination with your infrastructure or platform teams is the necessary first step to schedule updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.