CVE-2026-68160

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A pre-authentication out-of-bounds read exists in the ceph handle caps() function. The issue occurs because the function reads the snap trace len variable from the ceph mds caps header and uses it to create an end pointer without proper validation. When the CEPH CAP OP IMPORT case is triggered, this pointer is passed to the ceph update snap trace() function, which uses ceph decode need() to decode a ceph mds snap realm structure.

If a malicious or compromised Metadata Server (MDS) sets the message header version to 1 and provides a snap trace len value of 0xFFFFFFFF, the bound check is bypassed. This allows the system to read data past the legitimate message buffer, potentially leading to further out-of-bounds reads of encoded snap arrays via the num snaps and num prior parent snaps variables.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.