CVE-2026-52955

Analyzed Analyzed - Analysis Complete

libceph Out-of-Bounds Access in Crush Map Decoding

Publication date: 2026-06-24

Last updated on: 2026-07-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in crush_decode() A message of type CEPH_MSG_OSD_MAP containing a crush map with at least one bucket has two fields holding the bucket algorithm. If the values in these two fields differ, an out-of-bounds access can occur. This is the case because the first algorithm field (alg) is used to allocate the correct amount of memory for a bucket of this type, while the second algorithm field inside the bucket (b->alg) is used in the subsequent processing. This patch fixes the issue by adding a check that compares alg and b->alg and aborts the processing in case they differ. Furthermore, b->alg is set to 0 in this case, because the destruction of the crush map also uses this field to determine the bucket type, which can again result in an out-of-bounds access when trying to free the memory pointed to by the fields of the bucket. To correctly free the memory allocated for the bucket in such a case, the corresponding call to kfree is moved from the algorithm-specific crush_destroy_bucket functions to the generic crush_destroy_bucket().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-14

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-13

NVD

CVE-2026-52955

EUVD

EUVD-2026-38823

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	2.6.34
linux	linux_kernel	2.6.34
linux	linux_kernel	2.6.34
linux	linux_kernel	2.6.34
linux	linux_kernel	2.6.34
linux	linux_kernel	2.6.34
linux	linux_kernel	2.6.34
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.2 (inc) to 6.6.141 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.91 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.33 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.10 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 2.6.34.1 (inc) to 5.10.258 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.
CWE-131	The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

Attack-Flow Graph

Mitigation Strategies

The vulnerability has been fixed by a patch in the Linux kernel that adds checks to prevent out-of-bounds access in the libceph crush_decode() function.

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this patch.

Executive Summary

This vulnerability exists in the Linux kernel's libceph component, specifically in the crush_decode() function. It involves a message type called CEPH_MSG_OSD_MAP that contains a crush map with at least one bucket. The crush map has two fields that hold the bucket algorithm. If these two fields have different values, it can lead to an out-of-bounds memory access.

The problem arises because the first algorithm field (alg) is used to allocate memory for the bucket, while the second algorithm field inside the bucket (b->alg) is used later during processing. If these values differ, the memory allocation and usage become inconsistent, causing potential out-of-bounds access.

The fix involves adding a check to compare these two algorithm fields and abort processing if they differ. Additionally, b->alg is set to 0 in such cases to prevent further out-of-bounds access during bucket destruction. The memory freeing logic is also adjusted to handle this safely.

Impact Analysis

This vulnerability can lead to out-of-bounds memory access in the Linux kernel's libceph component. Such memory access issues can cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or cause denial of service by exploiting the improper memory handling.

Hi! I’m here to help you understand CVE-2026-52955. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70