CVE-2026-68159

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the libceph component where the decode pg temp() function fails to properly bound a user-controlled length to CEPH PG MAX SIZE. This function is used for decoding pg temp and pg upmap data. When the apply upmap() or get temp osds() functions copy the decoded list into the fixed-size on-stack array struct ceph osds.osds[CEPH PG MAX SIZE], a monitor sending an OSDMap with an entry longer than 32 can trigger a stack out-of-bounds write. This can be observed in the ceph pg to up acting osds() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.