CVE-2026-52955 libceph: Fix potential out-of-bounds access in crush_decode()
An attacker can trigger an out-of-bounds access in the Linux kernel's Ceph client by sending a malformed CRUSH map, potentially leading to code execution or system crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-52955?
CVE-2026-52955 is a critical memory corruption vulnerability in Linux kernel, published on 24 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
libceph: Fix potential out-of-bounds access in crush_decode()
A message of type CEPH_MSG_OSD_MAP containing a crush map with at least one bucket has two fields holding the bucket algorithm. If the values in these two fields differ, an out-of-bounds access can occur. This is the case because the first algorithm field (alg) is used to allocate the correct amount of memory for a bucket of this type, while the second algorithm field inside the bucket (b->alg) is used in the subsequent processing.
This patch fixes the issue by adding a check that compares alg and b->alg and aborts the processing in case they differ. Furthermore, b->alg is set to 0 in this case, because the destruction of the crush map also uses this field to determine the bucket type, which can again result in an out-of-bounds access when trying to free the memory pointed to by the fields of the bucket. To correctly free the memory allocated for the bucket in such a case, the corresponding call to kfree is moved from the algorithm-specific crush_destroy_bucket functions to the generic crush_destroy_bucket().
Which versions are affected by CVE-2026-52955?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-52955?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-52955 being exploited?
There is no known exploitation of CVE-2026-52955 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-90500, BELL-CVE-2026-52955, DEBIAN-CVE-2026-52955, GHSA-jh5w-4gpm-r5xw, ROOT-OS-DEBIAN-11-CVE-2026-52955, ROOT-OS-DEBIAN-12-CVE-2026-52955 and 3 more.