libceph: Reject monmaps advertising zero monitors (Linux Linux)

CVE-2026-68155
HIGH 7.5

At a glance

Source
NVD
EPSS
EPSS 0.70 % · percentile 53 ()
State
PUBLISHED
Published
Updated
Assigner
Linux
NVD status
Received

Description

In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPH_MSG_MON_MAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the existing monitors in the cluster. Currently, a monmap indicating that there are zero monitors in the cluster is treated as valid. However, it is impossible to have zero monitors in the cluster and still receive a valid monmap from a monitor. Therefore, such a monmap must be corrupted and should be treated as invalid. Furthermore, a monmap with a monitor count of zero can subsequently crash the client when attempting to open a session with a monitor in __open_session(). This happens because the "BUG_ON(monc->monmap->num_mon < 1)" assertion in pick_new_mon() is triggered. This patch extends a check in ceph_monmap_decode() to also reject arriving mon_maps with num_mon == 0 rather than only with num_mon > CEPH_MAX_MON. [ idryomov: drop "log output for unusual values of num_mon" part ]

Weaknesses (CWE)

  • CWE-20 — Improper Input Validation

References

Scores

VersionScoreVectorScored by
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HLinux
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary)

European references

CERT-FR advisories

Affected products

ProductVersions
Linux · Linuxaffected ba75bb98cfb93b62c54af25bf67ff90857264bbe < ba5f0015bfd376d764163045a61c17be75f44dae ; affected ba75bb98cfb93b62c54af25bf67ff90857264bbe < caf082ef8609a6ac26159ce115f55ab7d00231a3 ; affected ba75bb98cfb93b62c54af25bf67ff90857264bbe < e3ccd4ecab09b22f507f49cb7ed9990c7158ceab ; affected ba75bb98cfb93b62c54af25bf67ff90857264bbe < 0591a15815b498be628a937146e44487d599ba33 ; affected ba75bb98cfb93b62c54af25bf67ff90857264bbe < cd0d41bc569632eaaeccde9d2a6bc919ec00c407 ; affected ba75bb98cfb93b62c54af25bf67ff90857264bbe < e67e8b694872c9bc66996040f9de9242f6236ed9
Linux · Linuxaffected 2.6.34 ; unaffected 0 < 2.6.34 ; unaffected 5.10.271 ≤ 5.10.* ; unaffected 5.15.216 ≤ 5.15.* ; unaffected 6.1.183 ≤ 6.1.* ; unaffected 6.6.148 ≤ 6.6.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD