CVE-2026-68433

What it is

In the Linux kernel, the following vulnerability has been resolved: libceph: bound get_version reply decode to front len handle_get_version_reply() uses msg->front_alloc_len as the decode boundary for MON_GET_VERSION_REPLY. That is the size of the reused reply buffer, not the number of bytes actually received. A truncated reply can therefore pass ceph_decode_need() and decode the second u64 from stale tail bytes left in the buffer by an earlier message, causing an uninitialized memory read. Use msg->front.iov_len as the receive-side decode boundary, matching other libceph reply handlers and limiting decoding to the bytes that were actually read from the wire.

At a glance

Exploitability

Can be exploited over the network without logging in. High risk of service disruption.

Exploit odds

0.4% chance of exploitation in the next 30 days (EPSS).

Fix

No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

1. 2026-08-12 00:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-19 22:17 UTC Last updatedMost recent change to the record

Details

Published

2026-08-12 00:17 UTC

Last modified

2026-10-19 22:17 UTC

Exploit probability

0.4% · EPSS, next 30 days

Weakness

CWE-125 · Out-of-bounds read

Record status

Received

Attack profile CVSS 3.1 · 8.6

Attack vector

Network

Complexity

Low

Privileges needed

None

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High