Look up another CVE · open CVE-2026-52957 in the interactive tracker

CVE-2026-52957

libceph: Fix potential null-ptr-deref in decode_choose_args()

7.5 EPSS 0.5% AV:N

Published 2026-06-24 (4 months ago) by the Linux kernel CNA. Subsystem net/ceph. Debian urgency: not yet assigned.

What to do, per Debian release

Debian's own status for CVE-2026-52957 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	fixedDLA-4665-1 · 2026-07-03 · text	6.1.176-1	Update the kernel and reboot. DLA-4665-1 shipped the fix on 2026-07-03, in 6.1.176-1. A running kernel keeps the old code until the machine restarts.
Debian 13trixie	fixed	6.12.94-1	Update the kernel and reboot. Fixed in 6.12.94-1. A running kernel keeps the old code until the machine restarts.
Debian 14forky	fixed	7.0.10-1	Update the kernel and reboot. Fixed in 7.0.10-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.0.10-1	Update the kernel and reboot. Fixed in 7.0.10-1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

A message of type CEPH_MSG_OSD_MAP contains an OSD map that itself contains a CRUSH map. When decoding this CRUSH map in crush_decode(), an array of max_buckets CRUSH buckets is decoded, where some indices may not refer to actual buckets and are therefore set to NULL. The received CRUSH map may optionally contain choose_args that get decoded in decode_choose_args(). When decoding a crush_choose_arg_map, a series of choose_args for different buckets is decoded, with the bucket_index being read from the incoming message. It is only checked that the bucket index does not exceed max_buckets, but not that it doesn't point to an index with a NULL bucket. If a (potentially corrupted) message contains a crush_choose_arg_map including such a bucket_index, a null pointer dereference may occur in the subsequent processing when attempting to access the bucket with the given index. This patch fixes the issue by extending the affected check. Now, it is only attempted to access the bucket if it is not NULL.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

net/ceph/osdmap.c

What this is: CEPH COMMON CODE (LIBCEPH)MAINTAINERS section matched on net/ceph/ · ceph-devel@vger.kernel.org · Supported
Kernel module: libceph

Check it on the machine

grep -w CONFIG_CEPH_LIB /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w libceph

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.

bookworm, trixie, forky, sidm

m: a loadable module on every flavour - check lsmod, can be blacklisted

Build switch: CONFIG_CEPH_LIB

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-06-24 (4 months ago)source
CVSS: 7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsource recompute it
Attack vector: network (AV:N)source
EPSS: 0.52%, higher than 43.1% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: not yet assignedsource
Subsystem: net/ceph

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
4.13	5.10.258	d55ffad8d422
4.13	5.15.209	301286c0ccd3
4.13	6.1.175	7169f326a23d
4.13	6.6.141	d7a65a34d245
4.13	6.12.91	312ec973efac
4.13	6.18.33	f2f95e6d4b97
4.13	7.0.10	a20e16ebfe2f
4.13	7.1	28b0a2ab8c82

Debian advisories

Advisory	Date	Shipped to	Debian
DLA-4671-1	2026-07-05	bullseye 6.1.176-1~deb11u1	tracker
DLA-4665-1	2026-07-03	bookworm 6.1.176-1	tracker
DLA-4664-1	2026-07-03	bullseye 5.10.259-1	tracker

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network: CEPH_MSG_OSD_MAP is received over Ceph monitor or OSD network connections and decoded by the kernel client. The vulnerable path is network message processing: messenger receive -> ceph_osdc_handle_map() -> ceph_osdmap_decode()/osdmap_apply_incremental() -> crush_decode() -> decode_choose_args().
AC:LAttack complexity, low: The attacker-controlled map can directly select a bucket_index within max_buckets whose bucket slot was decoded as NULL and set ids_size nonzero. No race or condition outside the sending peer's control is required.
PR:NPrivileges required, none: The message must pass the established Ceph connection/authentication and FSID gates, but a malicious or compromised Ceph peer needs no privileges on the vulnerable Linux system. Auth-none deployments and attacker-controlled Ceph peers make PR:N the highest defensible choice.
UI:NUser interaction, none: Once the kernel client is connected to the Ceph cluster, OSD map updates are processed asynchronously without a user opening a file or performing another action. A malicious peer can send the malformed map as normal cluster traffic.
S:UScope, unchanged: The impact is within the same vulnerable kernel security authority. This is not a VM escape, IOMMU bypass, or cross-scope sandbox escape.
C:NConfidentiality impact, none: The bug is a NULL pointer dereference while reading c->buckets[bucket_index]->size. It does not provide a data disclosure primitive.
I:NIntegrity impact, none: The vulnerable operation is not a write, UAF, type confusion, or controllable memory corruption. No integrity impact is supported beyond crashing the kernel.
A:HAvailability impact, high: Dereferencing the NULL bucket pointer can trigger a kernel oops or panic while processing a malformed OSD/CRUSH map. That is a high availability impact.