CVE-2026-68157

A flaw was found in libceph, a component of the Linux kernel. When processing a malformed CRUSH map, if a parent bucket's name exists but its type is missing, a null pointer dereference can occur. This issue can lead to a system crash, resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because triggering the flaw requires receiving an invalid CRUSH map from a storage cluster, restricting the blast radius to a system crash rather than arbitrary code execution or data leakage. By default, the libceph kernel module is not loaded on Red Hat Enterprise Linux installations unless Ceph-backed storage, such as CephFS mounts or RBD block devices, is explicitly configured. Systems that do not interact with Ceph storage infrastructures are not exposed to this issue during normal operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.