CVE-2026-52958: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-52958 Overview

CVE-2026-52958 is a Linux kernel vulnerability in the libceph subsystem. The flaw exists in the osdmap_decode() function, which parses incoming OSD (Object Storage Daemon) map messages from a Ceph cluster. The function decodes osd_state and osd_weight for each OSD up to map->max_osd iterations, but the ceph_decode_need() bounds check only accounts for a single sizeof(*map->osd_weight) instead of the full array length. A corrupted or malicious osdmap message advertising an inflated max_osd value can trigger an out-of-bounds read during decoding.

Critical Impact
A malformed Ceph OSD map message can cause out-of-bounds memory access in kernel space, potentially leading to information disclosure or kernel instability.

Affected Products

Linux kernel libceph subsystem (multiple stable branches)
Systems mounting Ceph (CephFS) or using RBD (RADOS Block Device) clients
Kernel builds prior to the fixes referenced in the upstream stable commits

Discovery Timeline

2026-06-24 - CVE-2026-52958 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52958

Vulnerability Analysis

The vulnerability resides in osdmap_decode() within the Linux kernel's libceph module. When the kernel processes an incoming OSD map, it iterates map->max_osd times to decode the osd_state and osd_weight arrays from the on-wire message. Prior to entering this loop, the code calls ceph_decode_need() to validate that the remaining buffer holds enough bytes for the upcoming reads.

The length passed to ceph_decode_need() accounted for only sizeof(*map->osd_weight), the size of a single element, rather than map->max_osd * sizeof(*map->osd_weight). When the attacker-controlled max_osd field in the message exceeds the actual payload size, the decoder reads past the end of the buffer. This results in an out-of-bounds read [CWE-125] within kernel address space.

Root Cause

The root cause is an undersized length argument in a bounds-check helper. The check validated space for one element while the subsequent loop consumed many elements. The fix updates the ceph_decode_need() invocation to account for map->max_osd * sizeof(*map->osd_weight) bytes, ensuring the entire decoded region is present before the loop executes.

Attack Vector

Exploitation requires the victim host to receive a crafted osdmap message from a Ceph monitor or an attacker positioned to inject Ceph protocol traffic. Any system mounting a Ceph filesystem or attaching an RBD volume from an untrusted or compromised cluster is exposed. The flaw is triggered during normal map decoding, so no authentication beyond cluster participation is required. The vulnerability is described in the upstream commit message rather than a public exploit. See the Linux Kernel Commit 36a7975 for the canonical patch.

Detection Methods for CVE-2026-52958

Indicators of Compromise

Kernel oops or panic messages referencing osdmap_decode, libceph, or ceph_decode_need in dmesg or /var/log/kern.log.
Unexpected disconnects or remounts of CephFS or RBD volumes following monitor map updates.
Anomalous Ceph protocol traffic from monitors with abnormally large max_osd field values relative to cluster size.

Detection Strategies

Inventory hosts running kernels with the libceph module loaded (lsmod | grep libceph) and compare against patched stable kernel versions.
Monitor kernel ring buffer entries for crash signatures originating in net/ceph/osdmap.c.
Inspect Ceph monitor traffic at the network layer for malformed or oversized osdmap payloads, particularly from untrusted network segments.

Monitoring Recommendations

Forward kernel logs to a centralized log platform and alert on libceph fault signatures.
Track kernel package versions across the fleet and flag hosts pinned to pre-patch builds.
Restrict and monitor network paths between Ceph clients and monitors to detect injection attempts.

How to Mitigate CVE-2026-52958

Immediate Actions Required

Apply the latest stable kernel update from your distribution that incorporates the upstream libceph fix.
Identify all hosts running Ceph kernel clients (CephFS mounts and rbd block devices) and schedule reboots to load the patched kernel.
Validate that Ceph monitor endpoints are only reachable from trusted networks to reduce exposure to crafted messages.

Patch Information

The issue is resolved across multiple stable branches via the following upstream commits: Linux Kernel Commit 0d2dd7e, Linux Kernel Commit 35d0ed8, Linux Kernel Commit 36a7975, Linux Kernel Commit 3f2575b, Linux Kernel Commit 48df98d, Linux Kernel Commit 8713bbc, Linux Kernel Commit e7187f3, and Linux Kernel Commit ee93369. The fix changes the ceph_decode_need() length argument to map->max_osd * sizeof(*map->osd_weight).

Workarounds

Unload the libceph kernel module on hosts that do not require Ceph connectivity using modprobe -r ceph rbd libceph.
Restrict Ceph monitor traffic to authenticated, trusted network segments via firewall rules.
Where feasible, migrate to userspace Ceph clients (librados, FUSE-based CephFS) until kernel patches are deployed.

bash

# Verify running kernel and libceph module status
uname -r
lsmod | grep -E 'libceph|ceph|rbd'

# Example: block Ceph monitor traffic from untrusted networks (port 3300/6789)
iptables -A INPUT -p tcp -m multiport --dports 3300,6789 \
  ! -s 10.0.0.0/24 -j DROP

# Unload Ceph kernel modules on hosts that do not need them
sudo umount -a -t ceph
sudo modprobe -r rbd ceph libceph