CyberSecBulletin
CVE-2026-68433NVD status: Received

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-68433 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 8.6 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 1307028f082756bf453e1889aee9983d30643a4b, f6cbf6878f3a1503c872ba8f1e69a58ee68d8b2e, 72a35070fcefa229b1b031aa7482ad3788e18f07 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.36% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 1307028f082756bf453e1889aee9983d30643a4b or f6cbf6878f3a1503c872ba8f1e69a58ee68d8b2e or 72a35070fcefa229b1b031aa7482ad3788e18f07 or 340e0386aa39da181015bee38f309018c335ce16, whichever matches your release line, or a later version.
  2. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux513a8243d67f8e8d27f2883bd2f18bc87c7ca376 up to, but not including, 1307028f082756bf453e1889aee9983d30643a4b; 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 up to, but not including, f6cbf6878f3a1503c872ba8f1e69a58ee68d8b2e; 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 up to, but not including, 72a35070fcefa229b1b031aa7482ad3788e18f07; 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 up to, but not including, 340e0386aa39da181015bee38f309018c335ce16; 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 up to, but not including, d60de8253c85a02d0e6194b0735e7a562981a04c; 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 up to, but not including, 4e7ebfaa0d14cf50e44041bfde38070d6dbc019f; 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 up to, but not including, 0d934c934ec746d53fc7e4f53239792647bbae63; 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 up to, but not including, d3c32939fa0e3ee9b883b9a0fd1972c5c444e3d0; and 1 more ranges1307028f082756bf453e1889aee9983d30643a4b, f6cbf6878f3a1503c872ba8f1e69a58ee68d8b2e, 72a35070fcefa229b1b031aa7482ad3788e18f07, 340e0386aa39da181015bee38f309018c335ce16, d60de8253c85a02d0e6194b0735e7a562981a04c, 4e7ebfaa0d14cf50e44041bfde38070d6dbc019f

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
LowSome restricted data can be read.
Integrity
LowLimited modification of data is possible.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: libceph: bound get_version reply decode to front len handle_get_version_reply() uses msg->front_alloc_len as the decode boundary for MON_GET_VERSION_REPLY. That is the size of the reused reply buffer, not the number of bytes actually received. A truncated reply can therefore pass ceph_decode_need() and decode the second u64 from stale tail bytes left in the buffer by an earlier message, causing an uninitialized memory read. Use msg->front.iov_len as the receive-side decode boundary, matching other libceph reply handlers and limiting decoding to the bytes that were actually read from the wire.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.