{"id":5362,"date":"2026-09-04T18:47:46","date_gmt":"2026-09-04T10:47:46","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-68158"},"modified":"2026-09-04T18:47:46","modified_gmt":"2026-09-04T10:47:46","slug":"cve-2026-68158","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-68158","title":{"rendered":"CVE-2026-68158 [CRITICAL] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Fix multipli"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>libceph: Fix multiplication overflow in decode_new_up_state_weight()<\/p>\n<p>If a message of type CEPH_MSG_OSD_MAP contains a (maliciously) corrupted<br \/>\nosdmap, out-of-bounds memory accesses may occur in<br \/>\ndecode_new_up_state_weight(). This happens because the bounds check for<br \/>\nthe new_state part is based on calculating its length depending on a len<br \/>\nvalue read from the incoming message. This calculation may overflow<br \/>\nleading to an incorrect bounds check. Subsequently, out-of-bounds reads<br \/>\nmay occur when decoding this part.<\/p>\n<p>This patch switches the multiplication to use check_mul_overflow() to<br \/>\nabort processing the osdmap if an overflow occurred. Therefore,<br \/>\nosdmaps\/messages containing large values for len that result in a<br \/>\nmultiplication overflow are treated as invalid.<\/p>\n<p>[ idryomov: rename new_state_len -&gt; new_state_item_size, formatting ]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>libceph: Fix multiplication overflow in decode_new_up_state_weight()<\/p>\n<p>If a message of type CEPH_MSG_OSD_MAP contains a (maliciously<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5362","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5362","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5362"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5362"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5362"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}