libceph: bound get_version reply decode to front len
In the Linux kernel, the following vulnerability has been resolved: libceph: bound get_version reply decode to front len handle_get_version_reply() uses msg->front_alloc_len as the decode boundary for MON_GET_VERSION_REPLY. That is the size of the reused reply buffer, not the number of bytes actually received. A truncated reply can therefore pass ceph_decode_need() and decode the second u64 from stale tail bytes left in the buffer by an earlier message, causing an uninitialized memory read. Use msg->front.iov_len as the receive-side decode boundary, matching other libceph reply handlers and limiting decoding to the bytes that were actually read from the wire.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.265, 5.15.216, 6.1.183, 6.12.101, 6.18.42, 6.6.148, 7.1.6
- CVEs
- CVE-2026-68433
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 04:35 UTC · Revision 1
Source evidence
libceph: bound get_version reply decode to front len
core-osv · Original sourcePublished 12 Aug 2026, 00:07 UTC
In the Linux kernel, the following vulnerability has been resolved: libceph: bound get_version reply decode to front len handle_get_version_reply() uses msg->front_alloc_len as the decode boundary for MON_GET_VERSION_REPLY. That is the size of the reused reply buffer, not the number of bytes actually received. A truncated reply can therefore pass ceph_decode_need() and decode the second u64 from stale tail bytes left in the buffer by an earlier message, causing an uninitialized memory read. Use msg->front.iov_len as the receive-side decode boundary, matching other libceph reply handlers and limiting decoding to the bytes that were actually read from the wire.
osv:CVE-2026-68433
Kernel
Fixed versions: 5.10.265, 5.15.216, 6.1.183, 6.6.148, 6.12.101, 6.18.42, 7.1.6
Complete source record
{
"id": "a2e5fa3a18ba0feb1ceae14f270e5e06db0751d8234fa9a8bf21267747f07634",
"url": "https://osv.dev/vulnerability/CVE-2026-68433",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "libceph: bound get_version reply decode to front len",
"summary": "In the Linux kernel, the following vulnerability has been resolved: libceph: bound get_version reply decode to front len handle_get_version_reply() uses msg->front_alloc_len as the decode boundary for MON_GET_VERSION_REPLY. That is the size of the reused reply buffer, not the number of bytes actually received. A truncated reply can therefore pass ceph_decode_need() and decode the second u64 from stale tail bytes left in the buffer by an earlier message, causing an uninitialized memory read. Use msg->front.iov_len as the receive-side decode boundary, matching other libceph reply handlers and limiting decoding to the bytes that were actually read from the wire.",
"evidence": "osv:CVE-2026-68433",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.10.265",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.216",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.183",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.148",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.101",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.42",
"evidence": "/affected/1/ranges"
},
{
"value": "7.1.6",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "CVE-2026-68433",
"aliases": [
"CVE-2026-68433"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376"
},
{
"fixed": "1307028f082756bf453e1889aee9983d30643a4b"
},
{
"fixed": "f6cbf6878f3a1503c872ba8f1e69a58ee68d8b2e"
},
{
"fixed": "72a35070fcefa229b1b031aa7482ad3788e18f07"
},
{
"fixed": "340e0386aa39da181015bee38f309018c335ce16"
},
{
"fixed": "d60de8253c85a02d0e6194b0735e7a562981a04c"
},
{
"fixed": "4e7ebfaa0d14cf50e44041bfde38070d6dbc019f"
},
{
"fixed": "0d934c934ec746d53fc7e4f53239792647bbae63"
},
{
"fixed": "d3c32939fa0e3ee9b883b9a0fd1972c5c444e3d0"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68433.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.16.0"
},
{
"fixed": "5.10.265"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.216"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.183"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.148"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.101"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.42"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.1.6"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68433.json"
}
}
],
"modified": "2026-10-28T02:30:25.611161931Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/0d934c934ec746d53fc7e4f53239792647bbae63",
"https://git.kernel.org/stable/c/1307028f082756bf453e1889aee9983d30643a4b",
"https://git.kernel.org/stable/c/340e0386aa39da181015bee38f309018c335ce16",
"https://git.kernel.org/stable/c/4e7ebfaa0d14cf50e44041bfde38070d6dbc019f",
"https://git.kernel.org/stable/c/72a35070fcefa229b1b031aa7482ad3788e18f07",
"https://git.kernel.org/stable/c/d3c32939fa0e3ee9b883b9a0fd1972c5c444e3d0",
"https://git.kernel.org/stable/c/d60de8253c85a02d0e6194b0735e7a562981a04c",
"https://git.kernel.org/stable/c/f6cbf6878f3a1503c872ba8f1e69a58ee68d8b2e",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68433.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-68433",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68433.json"
}
},
"related_cves": [
{
"value": "CVE-2026-68433",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 492489,
"published_at": "2026-08-12T00:07:20.455+00:00"
}