CVE-2026-52957

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential null-ptr-deref in decode_choose_args() A message of type CEPH_MSG_OSD_MAP contains an OSD map that itself contains a CRUSH map. When decoding this CRUSH map in crush_decode(), an array of max_buckets CRUSH buckets is decoded, where some indices may not refer to actual buckets and are therefore set to NULL. The received CRUSH map may optionally contain choose_args that get decoded in decode_choose_args(). When decoding a crush_choose_arg_map, a series of choose_args for different buckets is decoded, wi...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5 < d55ffad8d422b5d1cc44dad32bd3d25f4471cd9f, >= c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5 < 301286c0ccd37d66b0e40786fd35a4f19cdbd88a, >= c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5 < 7169f326a23d0f547fcd90e68b72fd387622e126, >= c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5 < d7a65a34d2453f8cd3e0cc0e1319740af7e24276, >= c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5 < 312ec973efac0efb9b9ed64214235910e9ecbaa8, >= c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5 < f2f95e6d4b97e70bb876139b0583fc8079983f85, >= c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5 < a20e16ebfe2fa65348eb4b2dc7deac330ce03e9c, >= c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5 < 28b0a2ab8c82d0bbdeb8013029c67c978ce6e4bf, >= 4.13, >= 4.13.1 < 5.10.258, >= 5.11 < 5.15.209, >= 5.16 < 6.1.175, >= 6.2 < 6.6.141, >= 6.7 < 6.12.91, >= 6.13 < 6.18.33, >= 6.19 < 7.0.10, 4.13, 7.1

Fixed versions

5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10

Technical data

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-476