CVE-2026-52957
Description
A flaw was found in the Linux kernel's libceph component. When processing a CEPH_MSG_OSD_MAP message containing a specially crafted CRUSH map, a remote attacker could potentially trigger a null pointer dereference. This issue arises during the decoding of crush_choose_arg_map if a bucket_index refers to a non-existent bucket. Successful exploitation of this vulnerability could lead to a system crash, resulting in a Denial of Service (DoS).
Statement
Moderate severity is assigned to this flaw because exploitation requires a system to actively communicate with a Ceph cluster where an attacker can supply an invalid CRUSH map, limiting the blast radius to a denial of service via a kernel crash. In standard Red Hat Enterprise Linux installations, the libceph module is not loaded by default unless CephFS or kernel RBD volumes are explicitly configured. Consequently, environments that do not interact with untrusted or compromised Ceph storage clusters are not exposed to this risk.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7 | N/A | 7.5 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | None |
| Integrity Impact | High | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
