CVE-2026-68154

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the libceph component where the crush decode() function fails to reject zero bucket types. Since CRUSH bucket type 0 is reserved for devices, a malformed CRUSH map can cause the mapper to treat a negative bucket ID as a device. This leads to the negative value being passed to the is out() function, which then indexes the OSD weight array with a negative value, potentially causing memory corruption or system instability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.