CVE-2026-52956
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
In the Linux kernel's libceph, a potential out-of-bounds access vulnerability was found in __ceph_x_decrypt(). An attacker can send a crafted authentication frame causing a read beyond the allocated buffer, potentially leading to information disclosure or system crash.
Risk Assessment
The risk involves a remote unauthenticated attacker triggering an out-of-bounds memory read, which could result in sensitive data leakage or system instability.
Recommendation
Immediately update the Linux kernel to a version containing the fix (commit adding buffer length check before accessing the ceph_x_encrypt_header structure).
Other vulnerabilities in Linux kernel
See all- CVE-2026-99284Unknown
In the Linux kernel, a vulnerability was resolved in the skb_zerocopy() function of the skbuff networking subsystem. The function does not propagate the shared-frag marker to the destination skb, breaking the invariant relied on by later in-place writers. As a result, an unprivileged user can write into the page cache of a root-owned read-only file.
- CVE-2026-99283Unknown
A bug in the Linux kernel netfilter conntrack TCP timeout selection was found. When an RST packet does not exactly match the expected sequence number, the conntrack entry remains ESTABLISHED, but the short CLOSE timeout (10 seconds) is still applied. A second non-exact RST can lower the timeout before the challenge ACK rate limit expires, allowing the conntrack entry to expire while both TCP endpoints remain established.
- CVE-2026-99282Unknown
In the Linux kernel, net/sched: sch_teql contains a use-after-free vulnerability. teql_master_xmit() incorrectly treats NET_XMIT_DROP as an unconsumed packet and operates on freed memory. The issue affects configurations with VLAN interfaces and pfifo qdisc with limit 0.
- CVE-2026-99281Unknown
A flaw in the Linux kernel tun/tap mechanism allowed processes without CAP_NET_ADMIN to attach to persistent tun devices that had no owner or group set. Anyone able to open /dev/net/tun could attach to such devices and intercept or inject network traffic. The fix now requires CAP_NET_ADMIN to attach to an ownerless, groupless device.
- CVE-2026-99280Unknown
In the Linux kernel, the following vulnerability has been resolved: ksmbd: drain session procfs readers before dropping table references. Session registration failure and connection cleanup can drop the table reference while the per-session procfs entry is still accessible. If a reader holds the last remaining reference, its final put calls proc_remove() from its own callback and waits for that callback to finish. Remove the procfs entry before dropping the table reference in the registration failure path. Queue sessions removed during connection cleanup and drain their procfs readers after releasing both session locks, then return their table references. Keep the global hash node unhashed while a session is queued so a concurrent unregister cannot drop the reference again. Previous-session replacement also destroys the file table before the session is finally freed. Detach the idr under the lock used by procfs file counters, and report zero files after it has been detached. This prevents a reader from accessing the idr during or after its destruction.
- CVE-2026-99278Unknown
In the Linux kernel, the following vulnerability has been resolved: ksmbd: limit sessions on each connection. The pending setup limit only counts InProgress sessions. A client can complete authentication repeatedly and retain an unbounded number of Valid sessions on one connection. Reserve a connection slot before allocating a session and retain a connection reference while authentication is in progress. The first SMB3 channel takes over that reservation; binding to another connection reserves one slot there. Reauthentication and authentication continuation reuse the existing reservation. Return slots on allocation or insertion failure, channel removal, and final session destruction. Accept max_sessions_per_connection in reserved startup-request space and default to 64 when older tools leave it zero. Keep the request size and existing field offsets unchanged. Expose the configured limit in procfs. The existing connection limits bound the aggregate number of sessions without a separate global session allocation limit.
- CVE-2026-99259Unknown
In the Linux kernel, the soc/tegra: pmc driver has an uninitialised early_pmc->rate variable for legacy 32-bit Tegra devices. The variable is never configured and remains 0, triggering a warning in tegra_pmc_enter_suspend_mode(). The issue appeared after the PMC driver was changed to create the PMC context dynamically, updating rate only in the new context.
- CVE-2026-99258Unknown
In the Linux kernel, hv_apicid_to_vp_index() uses per-CPU hypercall input and output pages. In an SEV-SNP CoCo VM without a paravisor the output page is not allocated, so the hypervisor stores the resulting VP index into memory not allocated by the guest. The fix uses the input page for both input and output.
- CVE-2026-99257Unknown
In the Linux kernel, the shared GPIO mechanism based on platform lookup tables requires an associated struct device. An fwnode-based lookup with no associated device currently causes a NULL-pointer dereference. The fix adds a check that lets the kernel gracefully handle this situation with an error.
- CVE-2026-99256Unknown
In the Linux kernel, the dm cache module used a rw_semaphore for background_work_lock, although write locks on rw_semaphores have strict owner semantics. The locking process was not always the same as the unlocking one, triggering a warning with CONFIG_DEBUG_RWSEMS during suspend/resume of a cache device. The fix replaces the rw_semaphore with a spinlock and a wait queue.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() In __ceph_x_decrypt(), a part of the buffer p is interpreted as a ceph_x_encrypt_header, and the magic field of this struct is accessed. This happens without any guarantee that the buffer is large enough to hold this struct. The function parameter ciphertext_len represents the length of the ciphertext to decrypt and is guaranteed to be at most the remaining size of the allocated buffer p. However, this value is not necessarily greater than sizeof(ceph_x_encrypt_header). E.g., a message frame of type FRAME_TAG_AUTH_REPLY_MORE, that is just as long to hold the ciphertext at its end with a ciphertext_len of 8 or less, can trigger an out-of-bounds memory access when accessing hdr->magic. This patch fixes the issue by adding a check to ensure that the decrypted plaintext in the buffer is large enough to represent at least the ceph_x_encrypt_header.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS