CVE-2026-52962In the Linux kernel, the following vulnerability has been resolved: ceph: fix a buffer leak in __ceph_setxattr() The old_blob in __ceph_setxattr() can store ci->i_xattrs.prealloc_blob value during th…
Updated under an hour ago ()
Does this affect you?
It affects linux_kernel. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ceph: fix a buffer leak in __ceph_setxattr() The old_blob in __ceph_setxattr() can store ci->i_xattrs.prealloc_blob value during the retry. However, it is never called the ceph_buffer_put() for the old_blob object. This patch fixes the issue of the buffer leak.
- CVSS
- 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-787
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Analyzed
- Record last updated
- Jul 14, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
linux linux_kernel linux:linux_kernel | from 4.4.192 before 4.5; from 4.9.192 before 4.10; from 4.14.143 before 4.15; from 4.19.72 before 4.20; from 5.2.14 before 5.3; from 5.3.1 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; and 11 more ranges | NVD |
References
- https://git.kernel.org/stable/c/3fa13ceefbc5f36131110342743994cb3de80637patch
- https://git.kernel.org/stable/c/4bfdcefdaa6092a06cacd59389c7756b36e6de8cpatch
- https://git.kernel.org/stable/c/521e5aba857fd267624892c8dd6295f22ce0267epatch
- https://git.kernel.org/stable/c/5d3cc36b4e77a27ce7b686b7c59c7072bcb3fa8epatch
- https://git.kernel.org/stable/c/7d3e8d2d648d5f0df29b4710246680f47695fe94patch
- https://git.kernel.org/stable/c/bc7abce4460e490dcb579eec770f175b150b685fpatch
- https://git.kernel.org/stable/c/d0cb994605c84a159c1d00d72cdc8583c321ef95patch
- https://git.kernel.org/stable/c/ecf94823c5c6a20790bb76ed2816822b0beb0c22patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.