CVE-2026-52958: Linux kernel libceph osdmap_decode out-of-bounds read

Overview

The record describes a fix in the libceph component of the Linux kernel. The osdmap_decode() function decodes osd_state and osd_weight for every OSD, but its length check (ceph_decode_need()) reserves space for only one osd_weight entry instead of all of them. The weakness is classified as CWE-125, Out-of-bounds Read.

Impact

• A corrupted osdmap message whose max_osd value is larger than the data actually present can make the kernel read memory beyond the intended buffer.
• The CNA-provided CVSS 3.1 base score is 9.1 (critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. This indicates network attack vector, low complexity, no privileges and no user interaction, with high confidence and availability impact and no integrity impact.
• The record does not state the concrete consequence, such as a crash or data disclosure. Any such outcome is an inference from the weakness class and the vector.

Affected products and versions

The record lists the Linux Linux Kernel product with these ranges:

• 5.3 up to but excluding 5.10.258
• 5.11 up to but excluding 5.15.209
• 5.16 up to but excluding 6.1.175
• 6.2 up to but excluding 6.6.141
• 6.7 up to but excluding 6.12.91
• 6.13 up to but excluding 6.18.33
• 6.19 up to but excluding 7.0.10
• 7.1-rc1, 7.1-rc2 and 7.1-rc3

The record does not list affected versions in any other form. Distribution kernels that backport the fix may differ from these upstream ranges, and the record does not say how they are labelled.

Exploitation status

The CISA KEV catalogue does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted. No EPSS score is available in the record.

Remediation and mitigation

• The record links patch commits in the stable kernel tree for the affected branches, as listed in the references. Apply the stable update that corresponds to your kernel branch, using the vendor or distribution packages that include these commits.
• Confirm after updating that the running kernel includes the fix. Check the kernel build against the patched commit list, not only the version number, because backports may vary.
• The record provides no workaround. Whether disabling or restricting the affected component is feasible is unknown from the available data.

Detection guidance

• Inventory Linux hosts and identify kernels within the listed ranges, including systems that use distribution kernels.
• Identify hosts that use the libceph component, for example kernel clients of Ceph storage. This is an inference from the component name and the nature of the flaw.
• Monitor for unexpected kernel crashes or memory errors on those hosts, and correlate them with Ceph cluster map traffic. The record does not describe specific indicators of compromise.

Limitations of the available information

• The record has no English title (title_en is null in the source), no EPSS data, and no SSVC data.
• The exact exploitability conditions, required network position and resulting impact are not described in the record.
• The record does not identify which distributions have shipped the fix or on what dates.

Frequently asked questions

What is the root cause of CVE-2026-52958?

The length check in osdmap_decode() accounts for only one osd_weight entry, while osd_state and osd_weight are decoded for each OSD, so a corrupted max_osd value can cause reads beyond the message content.

Is CVE-2026-52958 known to be actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.