CVE-2026-52955 Overview
CVE-2026-52955 is a Linux kernel vulnerability in the libceph subsystem. The flaw resides in the crush_decode() function, which parses CRUSH (Controlled Replication Under Scalable Hashing) maps received in CEPH_MSG_OSD_MAP messages. When a bucket inside the map carries two algorithm fields with mismatched values, the kernel can perform an out-of-bounds memory access. The first algorithm field controls memory allocation size, while the second field drives subsequent processing and destruction. This inconsistency leads to memory corruption during parsing or cleanup of the CRUSH map.
Critical Impact
A malformed Ceph OSD map can trigger an out-of-bounds access in the kernel, leading to memory corruption and potential denial of service against Ceph client systems.
Affected Products
- Linux kernel versions containing the vulnerable libcephcrush_decode() implementation
- Systems acting as Ceph clients (RBD, CephFS, RADOS) using the in-kernel Ceph driver
- Linux distributions shipping unpatched stable kernels prior to the fix commits
Discovery Timeline
- 2026-06-24 - CVE-2026-52955 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-52955
Vulnerability Analysis
The libceph kernel module parses CRUSH maps that arrive embedded in CEPH_MSG_OSD_MAP messages from a Ceph monitor or OSD. Each CRUSH bucket carries two algorithm identifiers: the outer alg value used during allocation, and the inner b->alg value referenced in later processing.
When these two fields disagree, the allocator reserves memory sized for one bucket variant while the parser interprets the structure as a different variant. Subsequent field reads and writes can fall outside the allocated region, producing an out-of-bounds access [CWE-125 / CWE-787]. The same mismatch also propagates into the teardown path, where the destruction logic uses b->alg to choose how to release algorithm-specific resources, compounding the issue with an unsafe kfree against an inconsistent structure.
The upstream patch introduces a consistency check that compares alg and b->alg and aborts processing when they differ. The fix also resets b->alg to 0 in the error path and relocates the bucket kfree from the algorithm-specific crush_destroy_bucket_* helpers into the generic crush_destroy_bucket() to ensure safe cleanup regardless of bucket type.
Root Cause
The root cause is missing input validation between two redundant fields in the CRUSH map wire format. The decoder trusts that the outer and inner algorithm identifiers agree without explicit verification, allowing a crafted map to desynchronize allocation size from interpretation logic.
Attack Vector
Exploitation requires delivering a malformed CEPH_MSG_OSD_MAP to a Linux Ceph client. An attacker positioned to influence Ceph monitor or OSD traffic, or one operating a malicious Ceph cluster that a victim connects to, can craft a map containing a bucket with mismatched algorithm fields to trigger the out-of-bounds access in kernel context.
No verified proof-of-concept exploit code is publicly available for this vulnerability. The fix is distributed across multiple stable-tree commits referenced in the kernel.org git advisories.
Detection Methods for CVE-2026-52955
Indicators of Compromise
- Unexpected kernel oops, panic, or KASAN reports referencing crush_decode, crush_destroy_bucket, or libceph in kernel logs
- Repeated Ceph client disconnects or remounts coinciding with OSD map updates from a specific monitor
- Anomalous Ceph monitor or OSD peers sending OSD map messages from unexpected network sources
Detection Strategies
- Enable CONFIG_KASAN on test systems to surface out-of-bounds reads and writes inside libceph during fuzzing or staging
- Monitor dmesg and journald for libceph, ceph:, and BUG: entries correlated with OSD map version changes
- Inspect Ceph traffic at the network boundary for unexpected sources delivering CEPH_MSG_OSD_MAP (message type 41)
Monitoring Recommendations
- Centralize kernel logs from Ceph client hosts and alert on crashes in net/ceph/ or fs/ceph/ call stacks
- Track Ceph monitor membership changes and reject unauthorized monitor endpoints via firewall policy
- Baseline normal CRUSH map update cadence and flag bursts that align with kernel instability
How to Mitigate CVE-2026-52955
Immediate Actions Required
- Apply the upstream Linux kernel patches listed in the kernel.org stable git commits for affected branches
- Update distribution kernels on all Ceph client hosts as vendor packages become available and reboot to activate the fix
- Restrict network access to Ceph monitor and OSD endpoints so only trusted cluster members can deliver OSD map messages
Patch Information
The fix is available in the Linux stable tree across multiple branches. Relevant commits include 0f3604c, 3f42508, 4c79fc2, 6e70ef5, cceb100, ea0d421, ebe76d5, and fb176a9. The patch adds a check comparing alg and b->alg, zeroes b->alg on mismatch, and consolidates bucket memory release into crush_destroy_bucket().
Workarounds
- Where patching is not immediately possible, unload the ceph and rbd kernel modules on hosts that do not require kernel-mode Ceph access
- Enforce strict network segmentation so Ceph clients only communicate with authenticated, trusted monitor and OSD nodes
- Prefer userspace Ceph clients (librados-based) on exposed systems until kernel updates are deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
