CVE-2026-68154

A flaw was found in the Linux kernel's libceph component. A remote attacker could provide a specially crafted CRUSH map with a zero bucket type. This malformed map could cause the system to treat a negative bucket ID as a device, leading to an out-of-bounds access when indexing the OSD weight array. This could result in a denial of service.

This vulnerability is evaluated as having Moderate impact because successful exploitation requires delivering a malicious or corrupted cluster map to a system operating a kernel Ceph client, an attack scenario normally restricted by network isolation and storage authentication. Under default enterprise deployments, the affected kernel module is not loaded unless Ceph storage services like CephFS or RBD are explicitly configured and mounted. Processing an invalid map structure triggers an out-of-bounds memory read that can destabilize the operating system, but does not grant direct arbitrary remote code execution without compromised cluster trust.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.