CVE-2026-52954: Linux Kernel Privilege Escalation Flaw

CVE-2026-52954 Overview

CVE-2026-52954 is a Linux kernel vulnerability in the libceph subsystem. The flaw resides in the decode_choose_args() function, which parses CRUSH map data delivered inside CEPH_MSG_OSD_MAP messages. A corrupted message containing two crush_choose_arg_map entries that share the same choose_args_index triggers an assertion failure in insert_choose_arg_map(). The assertion raises a kernel BUG, halting the affected kernel thread.

The issue affects Ceph client functionality in the Linux kernel and can be triggered by a malicious or malformed OSD map received from the network.

Critical Impact
A malformed Ceph OSD map message can trigger a kernel BUG in libceph, causing denial of service on the affected host.

Affected Products

Linux kernel libceph subsystem (multiple stable branches, per fix commits)
Systems mounting CephFS or using Ceph RBD via the in-kernel client
Distributions shipping the Linux kernel prior to the referenced stable patches

Discovery Timeline

2026-06-24 - CVE-2026-52954 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52954

Vulnerability Analysis

The Linux kernel Ceph client decodes OSD map messages of type CEPH_MSG_OSD_MAP, which embed a CRUSH map. The CRUSH map may optionally carry choose_args parsed by decode_choose_args(). The function reads num_choose_arg_maps from the message and decodes that many crush_choose_arg_map structures.

Each decoded entry is inserted into the choose_args rbtree of the parent crush_map, keyed by choose_args_index. The original code used an asserting rbtree insertion helper. When a message supplies two entries with the same choose_args_index, the duplicate key violates the helper's invariant and triggers a BUG(), taking down the kernel context that was processing the message.

This is a denial-of-service condition rooted in missing validation of attacker-controlled input from the network. The class falls under improper input validation in a kernel parser.

Root Cause

The root cause is the use of an asserting rbtree insertion function inside insert_choose_arg_map() without first validating that choose_args_index values are unique within the decoded set. Duplicate keys are a legal byte sequence on the wire but cannot exist in the in-memory tree, so the assertion fires instead of returning an error.

Attack Vector

An attacker capable of delivering a crafted CEPH_MSG_OSD_MAP to a vulnerable Ceph client can trigger the kernel BUG. This requires the ability to influence the OSD map received by the client, typically by controlling or impersonating a Ceph monitor, or by sitting on the network path used by the kernel client.

No verified public exploit code is available. The EPSS probability is 0.184%.

The vulnerability mechanism is described in prose. Refer to the upstream patches for the precise code change replacing the asserting insertion with the non-asserting variant and adding a failure path that rejects the message.

Detection Methods for CVE-2026-52954

Indicators of Compromise

Kernel BUG or Oops entries in dmesg referencing insert_choose_arg_map or decode_choose_args in the libceph module.
Unexpected termination of kernel threads handling Ceph OSD map messages on hosts mounting CephFS or RBD.
Repeated Ceph client reconnect or remount events following malformed OSD map delivery.

Detection Strategies

Monitor kernel logs for BUG traces originating from net/ceph/osdmap.c or related libceph symbols.
Inventory hosts running kernel versions that predate the stable commits listed in the references and flag them as exposed.
Inspect Ceph monitor traffic boundaries to confirm that only trusted monitor endpoints can deliver OSD maps to clients.

Monitoring Recommendations

Forward kernel ring buffer events to a centralized log pipeline and alert on libceph panics or BUGs.
Track Ceph client mount stability and reconnect counts as a proxy for parser crashes.
Validate kernel versions across the fleet against the patched commits referenced below.

How to Mitigate CVE-2026-52954

Immediate Actions Required

Apply the upstream stable kernel updates that include the libceph fix for decode_choose_args().
Restrict network reachability of Ceph monitors so only trusted endpoints can send OSD maps to kernel clients.
Reboot hosts after kernel upgrade to ensure the patched libceph module is active.

Patch Information

The fix replaces the asserting rbtree insertion with the non-asserting variant and rejects the message when insertion fails. Patched commits are available in the upstream stable trees:

Workarounds

Limit kernel Ceph client usage on hosts that cannot be patched immediately, and prefer userspace clients where feasible.
Place Ceph monitor traffic on isolated management networks to reduce the attack surface for malformed OSD maps.
Block untrusted hosts from reaching Ceph monitor ports using host or network firewalls until kernels are updated.

bash

# Verify the running kernel and libceph module version
uname -r
modinfo libceph | grep -E '^(version|srcversion|filename)'

# Example: restrict Ceph monitor traffic to a trusted subnet
iptables -A INPUT -p tcp --dport 6789 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 6789 -j DROP