cve.bz

CVE-2026-52958

9.1 criticalEPSS 0.7%

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in osdmap_decode() When decoding osd_state and osd_weight from an incoming osdmap in osdmap_decode(), both are decoded for each osd, i.e., map->max_osd times. The ceph_decode_need() check only accounts for sizeof(*map->osd_weight) once. This can potentially result in an out-of-bounds memory access if the incoming message is corrupted such that the max_osd value exceeds the actual content of the osdmap message. This patch fixes the issue by changing the corresponding part in the ceph_decode_need() check to account for map->max_osd*sizeof(*map->osd_weight).

CVSS 3.1
9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS
0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-25)
CWE
CWE-125
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON