CVE-2026-68160

An IMPORTANT severity pre-authentication out-of-bounds read flaw was found in the Linux kernel's Ceph client. In ceph_handle_caps(), the snap_trace_len value taken from the wire-format capability message header is used without validation against the message buffer when a malicious or compromised Ceph metadata server (MDS) sends a message with a header version of 1, bypassing the version-gated decoders that normally validate this length. By supplying an attacker-chosen length such as 0xFFFFFFFF, the MDS makes ceph_update_snap_trace() decode past the legitimate message buffer, resulting in out-of-bounds reads of kernel memory that can lead to information disclosure or a denial of service through a kernel panic. Red Hat Enterprise Linux 7, 8, 9, and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS are affected by this flaw, and fixes are being pursued for the affected products. Red Hat Enterprise Linux 6 is not affected because the vulnerable code is not present in that kernel. Red Hat rates this flaw as IMPORTANT (CVSS 7.0), lower than the CRITICAL (9.8) rating in the upstream CVE record, because exploitation requires a malicious or already-compromised MDS within a Ceph cluster that the client communicates with, a significant precondition that limits practical exploitability.