In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in osdmap_decode() When decoding osd_state and osd_weight from an incoming osdmap in osdmap_decode(), both are decoded for each osd, i.e., map->max_osd times. The ceph_decode_need() check only accounts for sizeof(*map->osd_weight) once. This can potentially result in an out-of-bounds memory access if the incoming message is corrupted such that the max_osd value exceeds the actual content of the osdmap message. This patch fixes the issue by changing the corresponding part in the ceph_decode_need() check to account for map->max_osd*sizeof(*map->osd_weight).

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/0d2dd7e6bb74fd7712aa73457a4a821906c6863a cve-icon
https://git.kernel.org/stable/c/35d0ed82d03e5ee77ea4f31f20e29562a7721649 cve-icon
https://git.kernel.org/stable/c/36a79759a288961b1ff28a68ec2d1f56f6848098 cve-icon
https://git.kernel.org/stable/c/3f2575bb7f955d42569d96c3e04fa958a0dcf4b4 cve-icon
https://git.kernel.org/stable/c/48df98d12b15360cd56af5c1f460307b340c1197 cve-icon
https://git.kernel.org/stable/c/8713bbc4b2b9ad78f803978e54b7e49dd21bd9be cve-icon
https://git.kernel.org/stable/c/e7187f33c02488697ec0d01d82bf7a3f8deaba8f cve-icon
https://git.kernel.org/stable/c/ee933694645dac062d65fc2743f92bc06fa0db6b cve-icon
https://lore.kernel.org/linux-cve-announce/2026062436-CVE-2026-52958-a72e@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-52958 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-52958 cve-icon
History

Sun, 28 Jun 2026 08:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'}

Fri, 26 Jun 2026 04:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
CWE-125

Fri, 26 Jun 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1284
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Wed, 24 Jun 2026 18:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
CWE-125

Wed, 24 Jun 2026 17:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in osdmap_decode() When decoding osd_state and osd_weight from an incoming osdmap in osdmap_decode(), both are decoded for each osd, i.e., map->max_osd times. The ceph_decode_need() check only accounts for sizeof(*map->osd_weight) once. This can potentially result in an out-of-bounds memory access if the incoming message is corrupted such that the max_osd value exceeds the actual content of the osdmap message. This patch fixes the issue by changing the corresponding part in the ceph_decode_need() check to account for map->max_osd*sizeof(*map->osd_weight).
Title libceph: Fix potential out-of-bounds access in osdmap_decode()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-24T16:28:39.723Z

Updated: 2026-06-28T06:37:19.643Z

Reserved: 2026-06-09T07:44:35.373Z

Link: CVE-2026-52958

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-06-24T00:00:00Z

Links: CVE-2026-52958 - Bugzilla