CVE-2026-52957
published 2026-06-24CVE-2026-52957: In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential null-ptr-deref in decode_choose_args() A message of type…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.53%
41.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
libceph: Fix potential null-ptr-deref in decode_choose_args()
A message of type CEPH_MSG_OSD_MAP contains an OSD map that itself
contains a CRUSH map. When decoding this CRUSH map in crush_decode(), an
array of max_buckets CRUSH buckets is decoded, where some indices may
not refer to actual buckets and are therefore set to NULL. The received
CRUSH map may optionally contain choose_args that get decoded in
decode_choose_args(). When decoding a crush_choose_arg_map, a series of
choose_args for different buckets is decoded, with the bucket_index
being read from the incoming message. It is only checked that the bucket
index does not exceed max_buckets, but not that it doesn't point to an
index with a NULL bucket. If a (potentially corrupted) message contains
a crush_choose_arg_map including such a bucket_index, a null pointer
dereference may occur in the subsequent processing when attempting to
access the bucket with the given index.
This patch fixes the issue by extending the affected check. Now, it is
only attempted to access the bucket if it is not NULL.
Affected
34 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5 < d55ffad8d422b5d1cc44dad32bd3d25f4471cd9f | d55ffad8d422b5d1cc44dad32bd3d25f4471cd9f |
| linux | linux | >= c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5 < 301286c0ccd37d66b0e40786fd35a4f19cdbd88a | 301286c0ccd37d66b0e40786fd35a4f19cdbd88a |
| linux | linux | >= c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5 < 7169f326a23d0f547fcd90e68b72fd387622e126 | 7169f326a23d0f547fcd90e68b72fd387622e126 |
| linux | linux | >= c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5 < d7a65a34d2453f8cd3e0cc0e1319740af7e24276 | d7a65a34d2453f8cd3e0cc0e1319740af7e24276 |
| linux | linux | >= c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5 < 312ec973efac0efb9b9ed64214235910e9ecbaa8 | 312ec973efac0efb9b9ed64214235910e9ecbaa8 |
| linux | linux | >= c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5 < f2f95e6d4b97e70bb876139b0583fc8079983f85 | f2f95e6d4b97e70bb876139b0583fc8079983f85 |
| linux | linux | >= c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5 < a20e16ebfe2fa65348eb4b2dc7deac330ce03e9c | a20e16ebfe2fa65348eb4b2dc7deac330ce03e9c |
| linux | linux | >= c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5 < 28b0a2ab8c82d0bbdeb8013029c67c978ce6e4bf | 28b0a2ab8c82d0bbdeb8013029c67c978ce6e4bf |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 4.13.1 < 5.10.258 | 5.10.258 |
| linux | linux_kernel | >= 5.11 < 5.15.209 | 5.15.209 |
| linux | linux_kernel | >= 5.16 < 6.1.175 | 6.1.175 |
| linux | linux_kernel | >= 6.13 < 6.18.33 | 6.18.33 |
| linux | linux_kernel | >= 6.19 < 7.0.10 | 7.0.10 |
| linux | linux_kernel | >= 6.2 < 6.6.141 | 6.6.141 |
| linux | linux_kernel | >= 6.7 < 6.12.91 | 6.12.91 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.0MEDIUM
vendor_ubuntu7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 7.0
CVE-2026-46108 [HIGH] Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- PSP security protocol;
- ARM64 architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Intel NPU Driver;
- DRBD D
Ubuntu
Linux kernel (HWE) vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (HWE) vulnerabilities
Title: Linux kernel (HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that the Linux kernel did not properly handle shared page
fragments during socket buffer operations, collectively known as Dirty
Frag. A logic flaw existed in the XFRM ESP-in-TC
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacke
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 7.0
CVE-2026-46113 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- PSP security protocol;
- ARM64 architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Intel NPU Driver;
- DRBD Distrib
Red Hat
kernel: libceph: Fix potential null-ptr-deref in decode_choose_args()
vendor_redhat·2026-06-24·CVSS 7.0
CVE-2026-52957 [MEDIUM] CWE-1285 kernel: libceph: Fix potential null-ptr-deref in decode_choose_args()
kernel: libceph: Fix potential null-ptr-deref in decode_choose_args()
In the Linux kernel, the following vulnerability has been resolved:
libceph: Fix potential null-ptr-deref in decode_choose_args()
A message of type CEPH_MSG_OSD_MAP contains an OSD map that itself
contains a CRUSH map. When decoding this CRUSH map in crush_decode(), an
array of max_buckets CRUSH buckets is decoded, where some indices may
not refer to actual buckets and are therefore set to NULL. The received
CRUSH map may optionally contain choose_args that get decoded in
decode_choose_args(). When decoding a crush_choose_arg_map, a series of
choose_args for different buckets is decoded, with the bucket_index
being read from the incoming message. It is only checked that the bucket
index does not exceed max_buckets, but
VulDB
Linux Kernel up to 7.0.9 libceph decode_choose_args null pointer dereference (WID-SEC-2026-2077)
vuldb·2026-07-17·CVSS 7.5
CVE-2026-52957 [HIGH] Linux Kernel up to 7.0.9 libceph decode_choose_args null pointer dereference (WID-SEC-2026-2077)
A vulnerability, which was classified as critical, was found in Linux Kernel up to 7.0.9. Impacted is the function decode_choose_args of the component libceph. Executing a manipulation can lead to null pointer dereference.
This vulnerability is tracked as CVE-2026-52957. The attack is only possible within the local network. No exploit exists.
You should upgrade the affected component.
GHSA
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential null-ptr-deref in decode_choose_args() A message of type CEPH_MSG_OSD_MAP contains an OSD map that itself c
ghsa_unreviewed·2026-06-24
CVE-2026-52957 In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential null-ptr-deref in decode_choose_args() A message of type CEPH_MSG_OSD_MAP contains an OSD map that itself c
In the Linux kernel, the following vulnerability has been resolved:
libceph: Fix potential null-ptr-deref in decode_choose_args()
A message of type CEPH_MSG_OSD_MAP contains an OSD map that itself
contains a CRUSH map. When decoding this CRUSH map in crush_decode(), an
array of max_buckets CRUSH buckets is decoded, where some indices may
not refer to actual buckets and are therefore set to NULL. The received
CRUSH map may optionally contain choose_args that get decoded in
decode_choose_args(). When decoding a crush_choose_arg_map, a series of
choose_args for different buckets is decoded, with the bucket_index
being read from the incoming message. It is only checked that the bucket
index does not exceed max_buckets, but not that it doesn't point to an
index with a NULL bucket. If a (poten
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/28b0a2ab8c82d0bbdeb8013029c67c978ce6e4bfhttps://git.kernel.org/stable/c/301286c0ccd37d66b0e40786fd35a4f19cdbd88ahttps://git.kernel.org/stable/c/312ec973efac0efb9b9ed64214235910e9ecbaa8https://git.kernel.org/stable/c/7169f326a23d0f547fcd90e68b72fd387622e126https://git.kernel.org/stable/c/a20e16ebfe2fa65348eb4b2dc7deac330ce03e9chttps://git.kernel.org/stable/c/d55ffad8d422b5d1cc44dad32bd3d25f4471cd9fhttps://git.kernel.org/stable/c/d7a65a34d2453f8cd3e0cc0e1319740af7e24276https://git.kernel.org/stable/c/f2f95e6d4b97e70bb876139b0583fc8079983f85
2026-06-24
Published