CVE-2026-68433

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: libceph: bound get_version reply decode to front len handle_get_version_reply() uses msg->front_alloc_len as the decode boundary for MON_GET_VERSION_REPLY. That is the size of the reused reply buffer, not the number of bytes actually received. A truncated reply can therefore pass ceph_decode_need() and decode the second u64 from stale tail bytes left in the buffer by an earlier message, causing an uninitialized memory read. Use msg->front.iov_len as the receive-side decode boundary, matching other libceph reply handlers and limiting decoding to the bytes that were actually read from the wire.

Severity

HIGH

CVSS score

8.6 (v3.1)

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-08-12 00:17:43.403000

Last modified

2026-10-19 22:17:19.160000

View original CVE JSON

{
  "id": "CVE-2026-68433",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-08-12T00:17:43.403",
  "lastModified": "2026-10-19T22:17:19.160",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: bound get_version reply decode to front len\n\nhandle_get_version_reply() uses msg->front_alloc_len as the decode\nboundary for MON_GET_VERSION_REPLY.  That is the size of the reused\nreply buffer, not the number of bytes actually received.\n\nA truncated reply can therefore pass ceph_decode_need() and decode the\nsecond u64 from stale tail bytes left in the buffer by an earlier\nmessage, causing an uninitialized memory read.\n\nUse msg->front.iov_len as the receive-side decode boundary, matching\nother libceph reply handlers and limiting decoding to the bytes that\nwere actually read from the wire."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "net/ceph/mon_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
              "lessThan": "1307028f082756bf453e1889aee9983d30643a4b",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
              "lessThan": "f6cbf6878f3a1503c872ba8f1e69a58ee68d8b2e",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
              "lessThan": "72a35070fcefa229b1b031aa7482ad3788e18f07",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
              "lessThan": "340e0386aa39da181015bee38f309018c335ce16",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
              "lessThan": "d60de8253c85a02d0e6194b0735e7a562981a04c",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
              "lessThan": "4e7ebfaa0d14cf50e44041bfde38070d6dbc019f",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
              "lessThan": "0d934c934ec746d53fc7e4f53239792647bbae63",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
              "lessThan": "d3c32939fa0e3ee9b883b9a0fd1972c5c444e3d0",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "net/ceph/mon_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "3.16",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "3.16",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.10.265",
              "lessThanOrEqual": "5.10.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.216",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.183",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.148",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.101",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.42",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.1.6",
              "lessThanOrEqual": "7.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-16T15:48:55.526707Z",
          "id": "CVE-2026-68433",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0d934c934ec746d53fc7e4f53239792647bbae63",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/1307028f082756bf453e1889aee9983d30643a4b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/340e0386aa39da181015bee38f309018c335ce16",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4e7ebfaa0d14cf50e44041bfde38070d6dbc019f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/72a35070fcefa229b1b031aa7482ad3788e18f07",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d3c32939fa0e3ee9b883b9a0fd1972c5c444e3d0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d60de8253c85a02d0e6194b0735e7a562981a04c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f6cbf6878f3a1503c872ba8f1e69a58ee68d8b2e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}