CVE-2026-52955: Linux kernel libceph crush_decode() out-of-bounds access
CVE-2026-52955 affects the libceph component of the Linux kernel, where decoding a CRUSH map in crush_decode() can access memory out of bounds when the two algorithm fields of a bucket in an OSD map message disagree. The kernel CNA rates it critical with CVSS 3.1 score 9.8 and a network attack vector that requires no privileges or user interaction. CISA KEV does not list it and no confirmed exploitation appears in the sources consulted; fixes are referenced for several stable kernel lines.
Overview
CVE-2026-52955 is a kernel-level issue in libceph, the Ceph client library inside the Linux kernel. The flaw sits in crush_decode(), the routine that parses CRUSH maps delivered in OSD map messages. A bucket stores its algorithm twice; when the two copies differ, memory sized using one copy is later processed using the other, which can lead to out-of-bounds access.
Impact
- The kernel CNA assigns CVSS 3.1 score 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes network reachability with no privileges or user interaction.
- A second provider in the record lists a CVSS 3.1 score of 4.7. The record does not explain the difference between the two scores.
- The record classifies the weakness as CWE-125 (out-of-bounds read). The description speaks of out-of-bounds access in general, so the exact effect on memory is not fully specified by the sources.
Affected products and versions
The record lists the Linux kernel as the affected product and gives these ranges:
- From 2.6.34.1 up to but excluding 5.10.258
- From 5.11 up to but excluding 5.15.209
- From 5.16 up to but excluding 6.1.175
- From 6.2 up to but excluding 6.6.141
- From 6.7 up to but excluding 6.12.91
- From 6.13 up to but excluding 6.18.33
- From 6.19 up to but excluding 7.0.10
The record also lists 2.6.34 and several pre-release builds of the 2.6.34 and 7.1 development cycles. Check your distribution or vendor advisory for backport status, because the ranges above come from the record and do not cover every packaged kernel.
Exploitation status
The record does not list this CVE in CISA KEV, and no confirmed exploitation appears in the sources consulted. No public exploit details are present in the record.
Remediation and mitigation
- Identify systems running affected kernel branches, including hosts that use Ceph kernel clients for block or file storage.
- Apply the stable kernel updates from your distribution or from the upstream stable branch that matches your series. Based on the upper bounds of the listed ranges, the first release outside each range is the expected fixed point; confirm this with your vendor.
- If Ceph kernel client functionality is not needed on a host, reduce exposure by not loading the related modules, as an inference from the affected component.
- Track distribution advisories for backported fixes, because a vendor kernel may carry the fix without matching the upstream version number.
Detection guidance
- Inventory kernel versions and check whether the libceph module is loaded on storage clients.
- Review kernel logs for libceph or crush-related errors, memory faults or unexpected crashes during cluster map updates.
- Monitor Ceph cluster health and client reconnect events, since unusual map handling failures can be an early operational signal.
Limitations of the available information
The record provides no title, no EPSS score and no SSVC data. The sources do not describe a proof of concept or a real-world attack. Whether a given deployment can reach the vulnerable code path depends on its Ceph configuration, which the record does not cover. The fix commits are listed, but this analysis relies on the record description rather than a line-by-line review of each patch.
Frequently asked questions
What is CVE-2026-52955?
It is a flaw in the libceph component of the Linux kernel. When the two algorithm fields of a CRUSH bucket in an OSD map message differ, crush_decode() can access memory out of bounds.
Is this vulnerability being actively exploited?
CISA KEV does not list it, and no confirmed exploitation appears in the sources consulted. Treat the lack of listing as a current status, not a guarantee.
What should administrators do?
Check whether affected kernel branches are in use, apply the stable updates or distribution fixes for your series, and reduce exposure on hosts that do not need Ceph kernel clients.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.