CVE-2026-68154

Critical

Description

In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crush_decode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crush_decode() accepts a bucket with type 0, a malformed CRUSH map can make the mapper treat a negative bucket ID as a device and pass it to is_out(), which then indexes the OSD weight array with a negative value. Reject zero bucket types while decoding the CRUSH map so the invalid state never reaches the mapper.

SeverityCritical

CVSS9.8

Exploit probability—

Product

Linux

PublishedAug 10, 2026

First seenAug 10, 2026

Weakness typeCWE-20Improper input validation

How to fix

Update

Linux Linux952ca5dc99913d169263f59fd689f586729a13c1, 146461f09565afe3665e65b0423d3d6b0fe806c5, 80fc40e11cda1b5d990a3f69c6efa344fb5cd987, b8a9fb6bf806f9c4891e71ae1beab0c07c23a877, 826cd1de5802fd392922785f9b64d76e65d2a100, 3b2f1937f5fce8b7dd5432e7693e3cc8b5eece56, 70998f91030ee083ecb336a1dff0701c20a38081, 05f90284223381005d6bcddab3fda4a97f9c3401 or later

Affected products

Product	Affected versions	Fixed in
Linux Linux	f24e9980eb860d8600cbe5ef3d2fd9295320d229 ≤ v < 952ca5dc99913d169263f59fd689f586729a13c1, f24e9980eb860d8600cbe5ef3d2fd9295320d229 ≤ v < 146461f09565afe3665e65b0423d3d6b0fe806c5, f24e9980eb860d8600cbe5ef3d2fd9295320d229 ≤ v < 80fc40e11cda1b5d990a3f69c6efa344fb5cd987, f24e9980eb860d8600cbe5ef3d2fd9295320d229 ≤ v < b8a9fb6bf806f9c4891e71ae1beab0c07c23a877, f24e9980eb860d8600cbe5ef3d2fd9295320d229 ≤ v < 826cd1de5802fd392922785f9b64d76e65d2a100, f24e9980eb860d8600cbe5ef3d2fd9295320d229 ≤ v < 3b2f1937f5fce8b7dd5432e7693e3cc8b5eece56, f24e9980eb860d8600cbe5ef3d2fd9295320d229 ≤ v < 70998f91030ee083ecb336a1dff0701c20a38081, f24e9980eb860d8600cbe5ef3d2fd9295320d229 ≤ v < 05f90284223381005d6bcddab3fda4a97f9c3401, 2.6.34	952ca5dc99913d169263f59fd689f586729a13c1, 146461f09565afe3665e65b0423d3d6b0fe806c5, 80fc40e11cda1b5d990a3f69c6efa344fb5cd987, b8a9fb6bf806f9c4891e71ae1beab0c07c23a877, 826cd1de5802fd392922785f9b64d76e65d2a100, 3b2f1937f5fce8b7dd5432e7693e3cc8b5eece56, 70998f91030ee083ecb336a1dff0701c20a38081, 05f90284223381005d6bcddab3fda4a97f9c3401

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.