CVE-2026-52957: Linux Kernel Null Pointer Dereference

CVE-2026-52957 Overview

CVE-2026-52957 is a null pointer dereference vulnerability in the Linux kernel's libceph subsystem. The flaw resides in the decode_choose_args() function, which parses CRUSH map choose_args received in CEPH_MSG_OSD_MAP messages. When decoding a crush_choose_arg_map, the kernel validates that the bucket_index does not exceed max_buckets but fails to verify that the referenced bucket is non-NULL. A crafted or corrupted OSD map message can trigger dereference of a NULL bucket pointer during subsequent processing.

Critical Impact
A malformed Ceph OSD map message can trigger a kernel null pointer dereference in libceph, leading to a denial-of-service condition on systems mounting Ceph storage.

Affected Products

Linux kernel versions containing the libceph module with vulnerable decode_choose_args() logic
Systems using CephFS or RBD (RADOS Block Device) clients in the kernel
Distributions shipping affected stable kernel branches prior to the referenced fix commits

Discovery Timeline

2026-06-24 - CVE-2026-52957 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52957

Vulnerability Analysis

The vulnerability resides in the Ceph client code path that processes CEPH_MSG_OSD_MAP messages. An OSD map embeds a CRUSH map, which the kernel decodes in crush_decode(). During decoding, the kernel allocates an array of max_buckets CRUSH buckets. Not every slot represents a real bucket; sparse indices are explicitly initialized to NULL.

The CRUSH map may optionally carry choose_args, which are decoded by decode_choose_args(). For each entry in a crush_choose_arg_map, the function reads a bucket_index from the wire format. The existing validation only ensures bucket_index < max_buckets. It does not confirm the corresponding bucket pointer is non-NULL.

When later code accesses the bucket via this index, the kernel dereferences a NULL pointer, causing an oops and likely a kernel panic depending on configuration. This impacts availability of the affected host. [CWE-476: NULL Pointer Dereference] is the applicable weakness class.

Root Cause

The root cause is incomplete input validation. The decoder trusts that any in-range bucket_index references a valid bucket, but sparse bucket arrays may contain NULL slots. The fix extends the bounds check to also verify that buckets[bucket_index] is non-NULL before access.

Attack Vector

An attacker capable of delivering or influencing a malformed CEPH_MSG_OSD_MAP message to a vulnerable client can trigger the dereference. This typically requires a compromised or malicious Ceph monitor, an on-path adversary, or message corruption affecting hosts that mount Ceph storage in the kernel.

The vulnerability is a memory-safety bug rather than a parser-driven RCE primitive. Refer to the upstream commits including Kernel Commit 28b0a2ab and Kernel Commit 301286c0 for the corrective patches.

Detection Methods for CVE-2026-52957

Indicators of Compromise

Kernel oops or panic messages referencing decode_choose_args, crush_decode, or libceph in dmesg or /var/log/kern.log
Unexpected reboots or hangs on Ceph client hosts coinciding with OSD map updates
Ceph monitor connections from untrusted or unexpected source addresses preceding a crash

Detection Strategies

Compare running kernel versions against the fixed commits referenced in the kernel.org stable tree advisories
Inspect kdump crash artifacts for stack traces traversing decode_choose_args() and NULL bucket access
Correlate Ceph cluster events with client-side kernel faults using centralized logging

Monitoring Recommendations

Forward kernel logs from all Ceph clients to a central log store and alert on panics referencing libceph
Monitor authenticity and integrity of cephx sessions to detect unauthorized monitor traffic
Track kernel package versions across the fleet and flag hosts running unpatched builds

How to Mitigate CVE-2026-52957

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the kernel.org stable commits and reboot affected hosts
Update distribution kernel packages from your vendor as soon as a fixed build is published
Restrict network exposure of Ceph monitors so only authorized clients can establish sessions

Patch Information

Upstream fixes are available in multiple stable branches via the following commits: Kernel Commit 28b0a2ab, Kernel Commit 301286c0, Kernel Commit 312ec973, Kernel Commit 7169f326, Kernel Commit a20e16eb, Kernel Commit d55ffad8, Kernel Commit d7a65a34, and Kernel Commit f2f95e6d. The fix adds a NULL check before accessing the bucket referenced by bucket_index in decode_choose_args().

Workarounds

Where patching is not immediately possible, isolate Ceph client traffic to trusted network segments and authenticated monitors only
Consider switching to user-space Ceph clients (such as librbd via QEMU or ceph-fuse) on hosts that cannot be promptly patched, eliminating the in-kernel decoder from the attack path
Enforce strict firewall rules limiting which hosts may send messages to kernel Ceph clients

bash

# Verify the running kernel and confirm a fixed build is installed
uname -r
# Example: limit Ceph monitor traffic to authorized peers only
iptables -A INPUT -p tcp --dport 3300 -s <trusted-mon-cidr> -j ACCEPT
iptables -A INPUT -p tcp --dport 6789 -s <trusted-mon-cidr> -j ACCEPT
iptables -A INPUT -p tcp --dport 3300 -j DROP
iptables -A INPUT -p tcp --dport 6789 -j DROP