CVE-2026-52962

ceph: fix a buffer leak in __ceph_setxattr()

Published Jun 24, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix a buffer leak in __ceph_setxattr()

The old_blob in __ceph_setxattr() can store
ci->i_xattrs.prealloc_blob value during the retry.
However, it is never called the ceph_buffer_put()
for the old_blob object. This patch fixes the issue of
the buffer leak.

Analysis

Technical impact

The Linux kernel contains a flaw in the __ceph_setxattr() routine where an old_blob buffer created during a retry is never freed, creating a buffer leak (CWE‑772). Additionally, the vulnerability is classified under CWE‑787, indicating a related out‑of‑bounds write risk. The leak can accumulate over time until the system exhausts kernel memory, potentially rendering the machine unstable or unavailable.

Affected Systems

All Linux kernels that include the Ceph filesystem driver before the patch that invokes ceph_buffer_put on the old_blob object are affected. The specific version range is not enumerated in the advisory, but any kernel build prior to the hardened commit is vulnerable.

Risk and Exploitability

With a CVSS score of 7.8 the vulnerability is high severity, and an EPSS score of < 1 % indicates a very low but non‑zero likelihood of exploitation. The issue is not listed in the CISA KEV catalog. The likely scenario requires local or privileged access to a Ceph‑mounted filesystem; an attacker could repeatedly trigger the buggy call to drain memory, leading to denial of service.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`86968ef21596515958d5f0a40233d02be78ecec0`	affected	< 521e5aba857fd267624892c8dd6295f22ce0267e
`86968ef21596515958d5f0a40233d02be78ecec0`	affected	< d0cb994605c84a159c1d00d72cdc8583c321ef95
`86968ef21596515958d5f0a40233d02be78ecec0`	affected	< ecf94823c5c6a20790bb76ed2816822b0beb0c22
`86968ef21596515958d5f0a40233d02be78ecec0`	affected	< 4bfdcefdaa6092a06cacd59389c7756b36e6de8c
`86968ef21596515958d5f0a40233d02be78ecec0`	affected	< 7d3e8d2d648d5f0df29b4710246680f47695fe94
`86968ef21596515958d5f0a40233d02be78ecec0`	affected	< 3fa13ceefbc5f36131110342743994cb3de80637
`86968ef21596515958d5f0a40233d02be78ecec0`	affected	< bc7abce4460e490dcb579eec770f175b150b685f
`86968ef21596515958d5f0a40233d02be78ecec0`	affected	< 5d3cc36b4e77a27ce7b686b7c59c7072bcb3fa8e
`1d86cb8d3204337e1853b84d69ea0f30dc0ba973`	affected	—
`9cec64d3f6d91da590cc4069172254067b43d0b2`	affected	—
`de30fc2ca852365ed635f62d7d818bffc15e55c9`	affected	—
`dfb8712c7acce0689aed6c400a22b35f4d2861fe`	affected	—
`f41cd559f1f3412db8e0acdede05ecf990ebfd8a`	affected	—
`4.4.192`	affected	< 4.5
`4.9.192`	affected	< 4.10
`4.14.143`	affected	< 4.15
`4.19.72`	affected	< 4.20
`5.2.14`	affected	< 5.3

Linux

affected

Version	Status	Constraints
`5.3`	affected	—
`0`	unaffected	< 5.3
`5.10.258`	unaffected	≤ 5.10.*
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.141`	unaffected	≤ 6.6.*
`6.12.91`	unaffected	≤ 6.12.*
`6.18.33`	unaffected	≤ 6.18.*
`7.0.10`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:5.3:-::::::
	cpe:2.3:o:linux:linux_kernel:5.3:rc6::::::
	cpe:2.3:o:linux:linux_kernel:5.3:rc7::::::
	cpe:2.3:o:linux:linux_kernel:5.3:rc8::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,521e5aba857fd267624892c8dd6295f22ce0267e)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d0cb994605c84a159c1d00d72cdc8583c321ef95)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ecf94823c5c6a20790bb76ed2816822b0beb0c22)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4bfdcefdaa6092a06cacd59389c7756b36e6de8c)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,7d3e8d2d648d5f0df29b4710246680f47695fe94)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,3fa13ceefbc5f36131110342743994cb3de80637)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,bc7abce4460e490dcb579eec770f175b150b685f)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,5d3cc36b4e77a27ce7b686b7c59c7072bcb3fa8e)`	affected	code_commit	—
`[0,5.10.258)`	affected	semver	—
`[0,5.15.209)`	affected	semver	—
`[0,6.1.175)`	affected	semver	—
`[0,6.6.141)`	affected	semver	—
`[0,6.12.91)`	affected	semver	—
`[0,6.18.33)`	affected	semver	—
`[0,7.0.10)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[5.10.258,5.11.0)`	unaffected	semver	—
`[5.15.209,5.16.0)`	unaffected	semver	—
`[6.1.175,6.2.0)`	unaffected	semver	—
`[6.6.141,6.7.0)`	unaffected	semver	—
`[6.12.91,6.13.0)`	unaffected	semver	—
`[6.18.33,6.19.0)`	unaffected	semver	—
`[7.0.10,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to a version that includes the fix which calls ceph_buffer_put on the old_blob object.
Disable or limit the use of Ceph extended attributes on production systems, restricting execution to trusted users or processes.
Monitor kernel memory usage for abnormal growth and plan for timely reboots if memory pressure threatens stability.
If Ceph is unnecessary, disable or remove the Ceph module from the kernel configuration to eliminate the attack surface.

Generated by OpenCVE AI on August 12, 2026 at 06:03 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4664-1	linux security update
Debian DLA	DLA-4665-1	linux security update
Debian DLA	DLA-4671-1	linux-6.1 security update
Ubuntu USN	USN-8566-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8567-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8568-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8569-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8574-1	Linux kernel (GCP FIPS) vulnerabilities
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8574-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8596-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-2	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8606-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8607-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8608-1	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8609-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8574-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-3	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8619-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8663-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8664-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8665-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8668-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8668-2	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.139% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/3fa13ceefbc5f36131110342743994cb3de80637
https://git.kernel.org/stable/c/4bfdcefdaa6092a06cacd59389c7756b36e6de8c
https://git.kernel.org/stable/c/521e5aba857fd267624892c8dd6295f22ce0267e
https://git.kernel.org/stable/c/5d3cc36b4e77a27ce7b686b7c59c7072bcb3fa8e
https://git.kernel.org/stable/c/7d3e8d2d648d5f0df29b4710246680f47695fe94
https://git.kernel.org/stable/c/bc7abce4460e490dcb579eec770f175b150b685f
https://git.kernel.org/stable/c/d0cb994605c84a159c1d00d72cdc8583c321ef95
https://git.kernel.org/stable/c/ecf94823c5c6a20790bb76ed2816822b0beb0c22
https://lore.kernel.org/linux-cve-announce/2026062437-CVE-2026-52962-69b4@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-52962
https://www.cve.org/CVERecord?id=CVE-2026-52962

History

Nov 7, 2026 7:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 27, 2026 2:30 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-401

Jun 27, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://lore.kernel.org/linux-cve-announce/2026062437-CVE-2026-52962-69b4@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-52962 https://www.cve.org/CVERecord?id=CVE-2026-52962
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Jun 24, 2026 6:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-401

Jun 24, 2026 5:15 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ceph: fix a buffer leak in __ceph_setxattr() The old_blob in __ceph_setxattr() can store ci->i_xattrs.prealloc_blob value during the retry. However, it is never called the ceph_buffer_put() for the old_blob object. This patch fixes the issue of the buffer leak.
Title		ceph: fix a buffer leak in __ceph_setxattr()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3fa13ceefbc5f36131110342743994cb3de80637 https://git.kernel.org/stable/c/4bfdcefdaa6092a06cacd59389c7756b36e6de8c https://git.kernel.org/stable/c/521e5aba857fd267624892c8dd6295f22ce0267e https://git.kernel.org/stable/c/5d3cc36b4e77a27ce7b686b7c59c7072bcb3fa8e https://git.kernel.org/stable/c/7d3e8d2d648d5f0df29b4710246680f47695fe94 https://git.kernel.org/stable/c/bc7abce4460e490dcb579eec770f175b150b685f https://git.kernel.org/stable/c/d0cb994605c84a159c1d00d72cdc8583c321ef95 https://git.kernel.org/stable/c/ecf94823c5c6a20790bb76ed2816822b0beb0c22