{"id":5363,"date":"2026-09-04T18:47:46","date_gmt":"2026-09-04T10:47:46","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-68159"},"modified":"2026-09-04T18:47:46","modified_gmt":"2026-09-04T10:47:46","slug":"cve-2026-68159","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-68159","title":{"rendered":"CVE-2026-68159 [CRITICAL] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: bound pg_{te"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE<\/p>\n<p>__decode_pg_temp() decodes an user-controlled length but only rejects<br \/>\nvalues large enough to overflow the allocation; it does not bound it to<br \/>\nCEPH_PG_MAX_SIZE. The helper backs both pg_temp and pg_upmap decoding, and<br \/>\napply_upmap()\/get_temp_osds() later copy the decoded list into the fixed-size<br \/>\non-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE]. A monitor that sends<br \/>\nan OSDMap with a pg_temp\/pg_upmap entry longer than 32 thus causes a stack<br \/>\nout-of-bounds write.<\/p>\n<p>An OSD set for a single PG can never exceed CEPH_PG_MAX_SIZE, so reject longer<br \/>\nentries at decode time. The bound is well below the old overflow threshold, so<br \/>\nit also covers the allocation-size overflow the previous check guarded against.<\/p>\n<p>  BUG: KASAN: stack-out-of-bounds in ceph_pg_to_up_acting_osds<br \/>\n  Write of size 4 &#8230; by task exploit<br \/>\n   kasan_report (mm\/kasan\/report.c:595)<br \/>\n   ceph_pg_to_up_acting_osds (net\/ceph\/osdmap.c:2617 net\/ceph\/osdmap.c:2833)<br \/>\n   calc_target (net\/ceph\/osd_client.c:1638)<br \/>\n   __submit_request (net\/ceph\/osd_client.c:2394)<br \/>\n   ceph_osdc_start_request (net\/ceph\/osd_client.c:2490)<br \/>\n   ceph_osdc_call (net\/ceph\/osd_client.c:5164)<br \/>\n   rbd_dev_image_probe (drivers\/block\/rbd.c:6899)<br \/>\n   do_rbd_add (drivers\/block\/rbd.c:7138)<br \/>\n   &#8230;<br \/>\n  kernel BUG at net\/ceph\/osdmap.c:2670!<\/p>\n<p>[ idryomov: do the same in __decode_pg_upmap_items() ]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE<\/p>\n<p>__decode_pg_temp() decodes an user-controlled length but onl<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5363","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5363","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5363"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5363"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5363"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}