CVE-2026-68433 libceph: bound get_version reply decode to front len
A truncated reply in libceph can cause an uninitialized memory read, potentially disclosing stale kernel memory to an attacker.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68433?
CVE-2026-68433 is a high-severity vulnerability in Linux, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
libceph: bound get_version reply decode to front len
handle_get_version_reply() uses msg->front_alloc_len as the decode boundary for MON_GET_VERSION_REPLY. That is the size of the reused reply buffer, not the number of bytes actually received.
A truncated reply can therefore pass ceph_decode_need() and decode the second u64 from stale tail bytes left in the buffer by an earlier message, causing an uninitialized memory read.
Use msg->front.iov_len as the receive-side decode boundary, matching other libceph reply handlers and limiting decoding to the bytes that were actually read from the wire.
Weakness: CWE-125
Which versions are affected by CVE-2026-68433?
How do I fix CVE-2026-68433?
Apply the vendor's patch.
Is CVE-2026-68433 being exploited?
There is no known exploitation of CVE-2026-68433 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-68433, DEBIAN-CVE-2026-68433, GHSA-w6pj-fv9f-22wf, UBUNTU-CVE-2026-68433.