CVE-2026-52955

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

libceph: Fix potential out-of-bounds access in crush_decode()

A message of type CEPH_MSG_OSD_MAP containing a crush map with at least

one bucket has two fields holding the bucket algorithm. If the values

in these two fields differ, an out-of-bounds access can occur. This is

the case because the first algorithm field (alg) is used to allocate

the correct amount of memory for a bucket of this type, while the second

algorithm field inside the bucket (b->alg) is used in the subsequent

processing.

This patch fixes the issue by adding a check that compares alg and

b->alg and aborts the processing in case they differ. Furthermore,

b->alg is set to 0 in this case, because the destruction of the crush

map also uses this field to determine the bucket type, which can again

result in an out-of-bounds access when trying to free the memory pointed

to by the fields of the bucket. To correctly free the memory allocated

for the buck

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References