CVE-2026-68158: Linux

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix multiplication overflow in decode_new_up_state_weight() If a message of type CEPH_MSG_OSD_MAP contains a (maliciously) corrupted osdmap, out-of-bounds memory accesses may occur in decode_new_up_state_weight(). This happens because the bounds check for the new_state part is based on calculating its length depending on a len value read from the incoming message. This calculation may overflow leading to an incorrect bounds check. Subsequently, out-of-bounds reads may occur when decoding this part. This patch switches the multiplication to use check_mul_overflow() to abort processing the osdmap if an overflow occurred. Therefore, osdmaps/messages containing large values for len that result in a multiplication overflow are treated as invalid. [ idryomov: rename new_state_len -> new_state_item_size, formatting ]

Affected products

• Linux Linux: from 3.10.103, before 3.11 (fixed in 3.11); from 3.12.63, before 3.13 (fixed in 3.13); from 3.14.75, before 3.15 (fixed in 3.15); from 3.16.39, before 3.17 (fixed in 3.17); from 3.18.39, before 3.19 (fixed in 3.19); from 4.1.30, before 4.2 (fixed in 4.2); …

Published 2026-08-10. Last modified 2026-08-19.