External risk intelligence

Linux Kernel libceph Integer Overflow Leads to Out-of-Bounds Access

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-68158

This vulnerability resides within the Ceph storage protocol implementation in the Linux kernel. Ceph OSD maps are typically exchanged between internal cluster nodes or specific authorized clients within a storage network, making direct public internet exposure uncommon in standard deployments.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Linux kernel's Ceph component could allow for out-of-bounds memory access if a message contains a corrupted OSD map. This occurs due to a multiplication overflow during message processing, potentially leading to unintended data reads. The fix ensures that such corrupted messages are treated as invalid, preventing the overflow and subsequent memory access issues.

Corrupted messages could cause memory access issues.
Matters if you use Linux kernel's Ceph component.
Confirm relevance and exposure to the Linux kernel Ceph component.

Attack Path

How an attacker could exploit the issue

An attacker could target the Linux kernel's Ceph component by sending a specially crafted message containing a corrupted OSD map. This corrupted data could cause an integer overflow during message processing, bypassing boundary checks. The vulnerability can lead to out-of-bounds memory access, potentially allowing an attacker to read or write to unintended memory locations.

No access needed.
Triggered by a corrupted message.
Risk of memory corruption.

Live Threat

Current exploitation, exposure, and threat context

A maliciously corrupted OSD map in a CEPH_MSG_OSD_MAP message could lead to out-of-bounds memory accesses within the Linux kernel's `decode_new_up_state_weight()` function. This occurs due to an integer overflow during the calculation of the message's bounds, potentially resulting in unintended information disclosure or system instability when processing these messages.

Kernel memory could be accessed.
Malformed OSD map messages could be sent.
System instability or data exposure may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Linux kernel's libceph component requires immediate attention from infrastructure and platform teams responsible for Ceph deployments. The first step is to identify all systems running the affected Linux kernel version, determine their exposure to untrusted input, and confirm their business criticality. Once these systems are identified, work with the accountable owner to plan and execute remediation, prioritizing systems with high exposure or criticality.

Platform/Infrastructure teams own remediation.
Verify Ceph OSD map exposure and criticality.
Plan risk-based remediation for affected systems.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the libceph component in the Linux kernel?

The libceph component is the library within the Linux kernel that facilitates communication for Ceph, a distributed storage system. It is responsible for handling network protocols that allow nodes to interact, specifically managing OSD (Object Storage Device) maps. These maps are critical because they define the cluster layout, telling the system where data is stored across various physical servers.

How does CVE-2026-68158 cause memory errors?

This vulnerability is an integer overflow. When the system processes an incoming OSD map, it performs a calculation to check if the message size is safe. A maliciously crafted, corrupted message can cause this calculation to wrap around, resulting in an incorrect, small size value. Because the system believes the data is smaller than it actually is, it fails to perform necessary boundary checks, leading to out-of-bounds memory access.

Do I need to be a direct user of the Ceph network to trigger this?

Triggering this requires sending a specially crafted CEPH_MSG_OSD_MAP message to a vulnerable host. It is not triggered by standard, healthy network traffic or typical administrative commands. The bug only manifests when the kernel attempts to decode a message containing corrupted, oversized, or malicious weight data, forcing the math to overflow.

Is my infrastructure at risk according to Halo Surface Signal?

Halo Surface Signal indicates that exploitation is unlikely for most systems. The Ceph storage protocol is typically restricted to internal cluster communication or authorized clients within a private storage network, rather than being directly exposed to the public internet. Therefore, the primary risk involves entities that already have some level of network access to your internal storage nodes.

What is the recommended first step to respond?

Begin by auditing your environment to identify all systems running the affected Linux kernel versions that utilize Ceph. Prioritize these findings based on how reachable those nodes are from untrusted network segments. Once your inventory is clear, coordinate with your infrastructure team to plan a kernel update, as the official fix mandates treating messages that cause calculation overflows as invalid, thereby neutralizing the trigger path.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.