CVE-2026-52955 - Vulnerability Details

- libceph: Fix potential out-of-bounds access in crush_decode()

Description

In the Linux kernel, the following vulnerability has been resolved:

libceph: Fix potential out-of-bounds access in crush_decode()

A message of type CEPH_MSG_OSD_MAP containing a crush map with at least
one bucket has two fields holding the bucket algorithm. If the values
in these two fields differ, an out-of-bounds access can occur. This is
the case because the first algorithm field (alg) is used to allocate
the correct amount of memory for a bucket of this type, while the second
algorithm field inside the bucket (b->alg) is used in the subsequent
processing.

This patch fixes the issue by adding a check that compares alg and
b->alg and aborts the processing in case they differ. Furthermore,
b->alg is set to 0 in this case, because the destruction of the crush
map also uses this field to determine the bucket type, which can again
result in an out-of-bounds access when trying to free the memory pointed
to by the fields of the bucket. To correctly free the memory allocated
for the bucket in such a case, the corresponding call to kfree is moved
from the algorithm-specific crush_destroy_bucket functions to the
generic crush_destroy_bucket().

Published: 2026-06-24

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A CEPH_MSG_OSD_MAP message can contain a crush map with at least one bucket whose two algorithm fields disagree. The first field determines the memory allocation size, while the second is used later in processing. If the values differ, crush_decode() may read beyond the allocated buffer, corrupting kernel.

Affected Systems

All Linux kernel builds that bundle libceph and have not applied the patch are in any kernel version compiled with libceph support prior to the inclusion of the fix referenced by this CVE, regardless of distribution.

Risk and Exploitability

The CVSS score of 9.8 reflects the critical impact of a kernel memory corruption. The EPSS score of less than 1% indicates a very low but nonzero chance of exploitation. An attacker could engineer a malicious CEPH_MSG_OSD_MAP from an untrusted Ceph OSD node to trigger the out-of-bounds read, potentially leading to privilege escalation or denial of service. No public exploit has been reported, but the vulnerability warrants prompt action.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`f24e9980eb860d8600cbe5ef3d2fd9295320d229`	affected	< 6e70ef53e818c53eab28d7b0026b7fd03dddaba5
`f24e9980eb860d8600cbe5ef3d2fd9295320d229`	affected	< ebe76d58a48a48031b98543d86c4cd30a825b622
`f24e9980eb860d8600cbe5ef3d2fd9295320d229`	affected	< 3f42508191e129ee6b5ea96578d5cab14f2a013a
`f24e9980eb860d8600cbe5ef3d2fd9295320d229`	affected	< ea0d42137f0c06da71e37ffc647aab4c5309599a
`f24e9980eb860d8600cbe5ef3d2fd9295320d229`	affected	< cceb10023e76bc89f3fe9238ebd0ccab0fc7c7c5
`f24e9980eb860d8600cbe5ef3d2fd9295320d229`	affected	< 0f3604cbe4df14c5e58288ac9f57511e726a222d
`f24e9980eb860d8600cbe5ef3d2fd9295320d229`	affected	< fb176a99e4c1a5a8448a83d83d3606203ba81faa
`f24e9980eb860d8600cbe5ef3d2fd9295320d229`	affected	< 4c79fc2d598694bda845b46229c9d48b65042970

Linux

affected

Version	Status	Constraints
`2.6.34`	affected	—
`0`	unaffected	< 2.6.34
`5.10.258`	unaffected	≤ 5.10.*
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.141`	unaffected	≤ 6.6.*
`6.12.91`	unaffected	≤ 6.12.*
`6.18.33`	unaffected	≤ 6.18.*
`7.0.10`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6e70ef53e818c53eab28d7b0026b7fd03dddaba5)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ebe76d58a48a48031b98543d86c4cd30a825b622)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,3f42508191e129ee6b5ea96578d5cab14f2a013a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ea0d42137f0c06da71e37ffc647aab4c5309599a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,cceb10023e76bc89f3fe9238ebd0ccab0fc7c7c5)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,0f3604cbe4df14c5e58288ac9f57511e726a222d)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,fb176a99e4c1a5a8448a83d83d3606203ba81faa)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4c79fc2d598694bda845b46229c9d48b65042970)`	affected	code_commit	—
`[0,5.10.258)`	affected	semver	—
`[0,5.15.209)`	affected	semver	—
`[0,6.1.175)`	affected	semver	—
`[0,6.6.141)`	affected	semver	—
`[0,6.12.91)`	affected	semver	—
`[0,6.18.33)`	affected	semver	—
`[0,7.0.10)`	affected	semver	—
`[0,7.0.10)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5.10.258,5.11.0)`	unaffected	semver	—
`[5.15.209,5.16.0)`	unaffected	semver	—
`[6.1.175,6.2.0)`	unaffected	semver	—
`[6.6.141,6.7.0)`	unaffected	semver	—
`[6.12.91,6.13.0)`	unaffected	semver	—
`[6.18.33,6.19.0)`	unaffected	semver	—
`[7.0.10,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the crush_decode patch.
Reboot the system or restart the Ceph services to activate the updated kernel.
If a kernel upgrade cannot be applied immediately, restrict the network paths to Ceph OSD nodes so that only trusted hosts can transmit CEPH_MSG_OSD_MAP messages, thereby reducing the chance of a crafted message reaching the kernel.

Generated by OpenCVE AI on June 28, 2026 at 13:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4664-1	linux security update
Debian DLA	DLA-4665-1	linux security update
Debian DLA	DLA-4671-1	linux-6.1 security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00377.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0f3604cbe4df14c5e58288ac9f57511e726a222d
https://git.kernel.org/stable/c/3f42508191e129ee6b5ea96578d5cab14f2a013a
https://git.kernel.org/stable/c/4c79fc2d598694bda845b46229c9d48b65042970
https://git.kernel.org/stable/c/6e70ef53e818c53eab28d7b0026b7fd03dddaba5
https://git.kernel.org/stable/c/cceb10023e76bc89f3fe9238ebd0ccab0fc7c7c5
https://git.kernel.org/stable/c/ea0d42137f0c06da71e37ffc647aab4c5309599a
https://git.kernel.org/stable/c/ebe76d58a48a48031b98543d86c4cd30a825b622
https://git.kernel.org/stable/c/fb176a99e4c1a5a8448a83d83d3606203ba81faa
https://lore.kernel.org/linux-cve-announce/2026062435-CVE-2026-52955-77f4@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-52955
https://www.cve.org/CVERecord?id=CVE-2026-52955

History

Sun, 28 Jun 2026 08:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Fri, 26 Jun 2026 03:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119

Fri, 26 Jun 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-131
References		https://lore.kernel.org/linux-cve-announce/2026062435-CVE-2026-52955-77f4@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-52955 https://www.cve.org/CVERecord?id=CVE-2026-52955
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Wed, 24 Jun 2026 19:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119

Wed, 24 Jun 2026 17:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in crush_decode() A message of type CEPH_MSG_OSD_MAP containing a crush map with at least one bucket has two fields holding the bucket algorithm. If the values in these two fields differ, an out-of-bounds access can occur. This is the case because the first algorithm field (alg) is used to allocate the correct amount of memory for a bucket of this type, while the second algorithm field inside the bucket (b->alg) is used in the subsequent processing. This patch fixes the issue by adding a check that compares alg and b->alg and aborts the processing in case they differ. Furthermore, b->alg is set to 0 in this case, because the destruction of the crush map also uses this field to determine the bucket type, which can again result in an out-of-bounds access when trying to free the memory pointed to by the fields of the bucket. To correctly free the memory allocated for the bucket in such a case, the corresponding call to kfree is moved from the algorithm-specific crush_destroy_bucket functions to the generic crush_destroy_bucket().
Title		libceph: Fix potential out-of-bounds access in crush_decode()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0f3604cbe4df14c5e58288ac9f57511e726a222d https://git.kernel.org/stable/c/3f42508191e129ee6b5ea96578d5cab14f2a013a https://git.kernel.org/stable/c/4c79fc2d598694bda845b46229c9d48b65042970 https://git.kernel.org/stable/c/6e70ef53e818c53eab28d7b0026b7fd03dddaba5 https://git.kernel.org/stable/c/cceb10023e76bc89f3fe9238ebd0ccab0fc7c7c5 https://git.kernel.org/stable/c/ea0d42137f0c06da71e37ffc647aab4c5309599a https://git.kernel.org/stable/c/ebe76d58a48a48031b98543d86c4cd30a825b622 https://git.kernel.org/stable/c/fb176a99e4c1a5a8448a83d83d3606203ba81faa

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-24T16:28:37.748Z

Updated: 2026-07-07T12:05:13.358Z

Reserved: 2026-06-09T07:44:35.373Z

Link: CVE-2026-52955

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Important

Publid Date: 2026-06-24T00:00:00Z

Links: CVE-2026-52955 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-28T13:45:06Z

Weaknesses

CWE-131
Incorrect Calculation of Buffer Size

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object