CVE-2026-52955

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in crush_decode() A message of type CEPH_MSG_OSD_MAP containing a crush map with at least one bucket has two fields holding the bucket algorithm. If the values in these two fields differ, an out-of-bounds access can occur. This is the case because the first algorithm field (alg) is used to allocate the correct amount of memory for a bucket of this type, while the second algorithm field inside the bucket (b->alg) is used in the subsequent processing. This patch fixes the issue by a...

Affected product and versions

Product

Linux Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6

Affected versions

>= f24e9980eb860d8600cbe5ef3d2fd9295320d229 < 6e70ef53e818c53eab28d7b0026b7fd03dddaba5, >= f24e9980eb860d8600cbe5ef3d2fd9295320d229 < ebe76d58a48a48031b98543d86c4cd30a825b622, >= f24e9980eb860d8600cbe5ef3d2fd9295320d229 < 3f42508191e129ee6b5ea96578d5cab14f2a013a, >= f24e9980eb860d8600cbe5ef3d2fd9295320d229 < ea0d42137f0c06da71e37ffc647aab4c5309599a, >= f24e9980eb860d8600cbe5ef3d2fd9295320d229 < cceb10023e76bc89f3fe9238ebd0ccab0fc7c7c5, >= f24e9980eb860d8600cbe5ef3d2fd9295320d229 < 0f3604cbe4df14c5e58288ac9f57511e726a222d, >= f24e9980eb860d8600cbe5ef3d2fd9295320d229 < fb176a99e4c1a5a8448a83d83d3606203ba81faa, >= f24e9980eb860d8600cbe5ef3d2fd9295320d229 < 4c79fc2d598694bda845b46229c9d48b65042970, >= 2.6.34, >= 2.6.34.1 < 5.10.258, >= 5.11 < 5.15.209, >= 5.16 < 6.1.175, >= 6.2 < 6.6.141, >= 6.7 < 6.12.91, >= 6.13 < 6.18.33, >= 6.19 < 7.0.10, 2.6.34, 7.1

Fixed versions

5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10

Technical data

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-125, CWE-131