CVE-2026-52955libceph: Fix potential out-of-bounds access in crush_decode()
Updated under an hour ago ()
Does this affect you?
It affects Linux and 2 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in crush_decode() A message of type CEPH_MSG_OSD_MAP containing a crush map with at least one bucket has two fields holding the bucket algorithm. If the values in these two fields differ, an out-of-bounds access can occur. This is the case because the first algorithm field (alg) is used to allocate the correct amount of memory for a bucket of this type, while the second algorithm field inside the bucket (b->alg) is used in the subsequent processing. This patch fixes the issue by adding a check that compares alg and b->alg and aborts the processing in case they differ. Furthermore, b->alg is set to 0 in this case, because the destruction of the crush map also uses this field to determine the bucket type, which can again result in an out-of-bounds access when trying to free the memory pointed to by the fields of the bucket. To correctly free the memory allocated for the bucket in such a case, the corresponding call to kfree is moved from the algorithm-specific crush_destroy_bucket functions to the generic crush_destroy_bucket().
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-131
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Analyzed
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from f24e9980eb860d8600cbe5ef3d2fd9295320d229 before 6e70ef53e818c53eab28d7b0026b7fd03dddaba5; from f24e9980eb860d8600cbe5ef3d2fd9295320d229 before ebe76d58a48a48031b98543d86c4cd30a825b622; from f24e9980eb860d8600cbe5ef3d2fd9295320d229 before 3f42508191e129ee6b5ea96578d5cab14f2a013a; from f24e9980eb860d8600cbe5ef3d2fd9295320d229 before ea0d42137f0c06da71e37ffc647aab4c5309599a; from f24e9980eb860d8600cbe5ef3d2fd9295320d229 before cceb10023e76bc89f3fe9238ebd0ccab0fc7c7c5; from f24e9980eb860d8600cbe5ef3d2fd9295320d229 before 0f3604cbe4df14c5e58288ac9f57511e726a222d; from f24e9980eb860d8600cbe5ef3d2fd9295320d229 before fb176a99e4c1a5a8448a83d83d3606203ba81faa; from f24e9980eb860d8600cbe5ef3d2fd9295320d229 before 4c79fc2d598694bda845b46229c9d48b65042970 | CNA record |
Red Hat Red Hat Enterprise Linux 10 redhat:enterprise_linux | 10 | CISA ADP |
linux linux_kernel linux:linux_kernel | from 2.6.34.1 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.141; from 6.7 before 6.12.91; from 6.13 before 6.18.33; from 6.19 before 7.0.10; 2.6.34; and 9 more ranges | NVD |
References
- https://git.kernel.org/stable/c/6e70ef53e818c53eab28d7b0026b7fd03dddaba5patch
- https://git.kernel.org/stable/c/ebe76d58a48a48031b98543d86c4cd30a825b622patch
- https://git.kernel.org/stable/c/3f42508191e129ee6b5ea96578d5cab14f2a013apatch
- https://git.kernel.org/stable/c/ea0d42137f0c06da71e37ffc647aab4c5309599apatch
- https://git.kernel.org/stable/c/cceb10023e76bc89f3fe9238ebd0ccab0fc7c7c5patch
- https://git.kernel.org/stable/c/0f3604cbe4df14c5e58288ac9f57511e726a222dpatch
- https://git.kernel.org/stable/c/fb176a99e4c1a5a8448a83d83d3606203ba81faapatch
- https://git.kernel.org/stable/c/4c79fc2d598694bda845b46229c9d48b65042970patch
- https://access.redhat.com/security/cve/CVE-2026-52955third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2492328third-party-advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52955.jsonthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.