CVE-2026-68160

A flaw was found in the Linux kernel's Ceph component. A remote attacker could exploit this by sending a specially crafted message with a manipulated snap_trace_len value. This pre-authentication vulnerability allows for an out-of-bounds read, potentially leading to information disclosure or a denial of service.

An IMPORTANT severity pre-authentication out-of-bounds read flaw was found in the Linux kernel's Ceph client. In ceph_handle_caps(), the snap_trace_len value taken from the wire-format capability message header is used without validation against the message buffer when a malicious or compromised Ceph metadata server (MDS) sends a message with a header version of 1, bypassing the version-gated decoders that normally validate this length. By supplying an attacker-chosen length such as 0xFFFFFFFF, the MDS makes ceph_update_snap_trace() decode past the legitimate message buffer, resulting in out-of-bounds reads of kernel memory that can lead to information disclosure or a denial of service through a kernel panic. Red Hat Enterprise Linux 7, 8, 9, and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS are affected by this flaw, and fixes are being pursued for the affected products. Red Hat Enterprise Linux 6 is not affected because the vulnerable code is not present in that kernel. Red Hat rates this flaw as IMPORTANT (CVSS 7.0), lower than the CRITICAL (9.8) rating in the upstream CVE record, because exploitation requires a malicious or already-compromised MDS within a Ceph cluster that the client communicates with, a significant precondition that limits practical exploitability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.