cbcvebase.
CVE-2026-52958
published 2026-06-24

CVE-2026-52958: In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in osdmap_decode() When decoding osd_state and…

PriorityP348critical9.1CVSS 3.1
AVNACLPRNUINSUCHINAH
EPSS
0.54%
42.0th percentile
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in osdmap_decode() When decoding osd_state and osd_weight from an incoming osdmap in osdmap_decode(), both are decoded for each osd, i.e., map->max_osd times. The ceph_decode_need() check only accounts for sizeof(*map->osd_weight) once. This can potentially result in an out-of-bounds memory access if the incoming message is corrupted such that the max_osd value exceeds the actual content of the osdmap message. This patch fixes the issue by changing the corresponding part in the ceph_decode_need() check to account for map->max_osd*sizeof(*map->osd_weight).

Affected

20 ranges
VendorProductVersion rangeFixed in
linuxlinux
linuxlinux>= dcbc919a5dc8c2629684a113a90c0b6fe10c3462 < 36a79759a288961b1ff28a68ec2d1f56f684809836a79759a288961b1ff28a68ec2d1f56f6848098
linuxlinux>= dcbc919a5dc8c2629684a113a90c0b6fe10c3462 < 3f2575bb7f955d42569d96c3e04fa958a0dcf4b43f2575bb7f955d42569d96c3e04fa958a0dcf4b4
linuxlinux>= dcbc919a5dc8c2629684a113a90c0b6fe10c3462 < 8713bbc4b2b9ad78f803978e54b7e49dd21bd9be8713bbc4b2b9ad78f803978e54b7e49dd21bd9be
linuxlinux>= dcbc919a5dc8c2629684a113a90c0b6fe10c3462 < 0d2dd7e6bb74fd7712aa73457a4a821906c6863a0d2dd7e6bb74fd7712aa73457a4a821906c6863a
linuxlinux>= dcbc919a5dc8c2629684a113a90c0b6fe10c3462 < e7187f33c02488697ec0d01d82bf7a3f8deaba8fe7187f33c02488697ec0d01d82bf7a3f8deaba8f
linuxlinux>= dcbc919a5dc8c2629684a113a90c0b6fe10c3462 < 48df98d12b15360cd56af5c1f460307b340c119748df98d12b15360cd56af5c1f460307b340c1197
linuxlinux>= dcbc919a5dc8c2629684a113a90c0b6fe10c3462 < ee933694645dac062d65fc2743f92bc06fa0db6bee933694645dac062d65fc2743f92bc06fa0db6b
linuxlinux>= dcbc919a5dc8c2629684a113a90c0b6fe10c3462 < 35d0ed82d03e5ee77ea4f31f20e29562a772164935d0ed82d03e5ee77ea4f31f20e29562a7721649
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel>= 5.11 < 5.15.2095.15.209
linuxlinux_kernel>= 5.16 < 6.1.1756.1.175
linuxlinux_kernel>= 5.3 < 5.10.2585.10.258
linuxlinux_kernel>= 6.13 < 6.18.336.18.33
linuxlinux_kernel>= 6.19 < 7.0.107.0.10
linuxlinux_kernel>= 6.2 < 6.6.1416.6.141
linuxlinux_kernel>= 6.7 < 6.12.916.12.91

CVSS provenance

nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.