CVE-2026-52958
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
In the Linux kernel, a potential out-of-bounds access vulnerability was found in the osdmap_decode() function of the libceph library. The ceph_decode_need() check did not account for the correct number of elements, which could lead to reading beyond the allocated buffer when processing a crafted OSD map message.
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized data access or cause a system crash by sending a specially crafted OSD map to a Ceph client.
Recommendation
Immediately update the Linux kernel to a version containing the fix (commit that changes ceph_decode_need() to account for map->max_osd*sizeof(*map->osd_weight)).
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in osdmap_decode() When decoding osd_state and osd_weight from an incoming osdmap in osdmap_decode(), both are decoded for each osd, i.e., map->max_osd times. The ceph_decode_need() check only accounts for sizeof(*map->osd_weight) once. This can potentially result in an out-of-bounds memory access if the incoming message is corrupted such that the max_osd value exceeds the actual content of the osdmap message. This patch fixes the issue by changing the corresponding part in the ceph_decode_need() check to account for map->max_osd*sizeof(*map->osd_weight).