critical CVSS 9.8

CVE-2026-52955·Kernel vulnerability

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in crush_decode() A message of type CEPH_MSG_OSD_MAP containing a crush map with at least one bucket has two fields holding the bucket algorithm. If the values in these two fields differ, an out-of-bounds access can occur. This is the case because the first algorithm field (alg) is used to allocate the correct amount of memory for a bucket of this type, while the second algorithm field inside the bucket (b->alg) is used in the subsequent processing. This patch fixes the issue by adding a check that compares alg and b->alg and aborts the processing in case they differ. Furthermore, b->alg is set to 0 in this case, because the destruction of the crush map also uses this field to determine the bucket type, which can again result in an out-of-bounds access when trying to free the memory pointed to by the fields of the bucket. To correctly free the memory allocated for the bucket in such a case, the corresponding call to kfree is moved from the algorithm-specific crush_destroy_bucket functions to the generic crush_destroy_bucket().

Severity
critical
Software
Kernel
Fixed in
7.0.10
Published

Affected versions

From: 6.19

Until: 7.0.10

Fixed in: 7.0.10

How to fix this CVE

Update your Linux kernel to version 7.0.10 or later to address a critical memory safety issue in the CRUSH map decoder. This vulnerability allows remote attackers to trigger out-of-bounds memory access during OSD map processing. Immediate patching is strongly recommended for all affected systems, particularly those running Ceph clusters or networked kernel services.

sudo dnf update kernel kernel-devel

Defensia detects this vulnerability

How to check if you are affected

  1. Run 'uname -r' and verify your kernel version is 7.0.10 or newer; versions 6.19 through 7.0.9 are vulnerable
  2. Check for Ceph OSD or MON services with 'systemctl status ceph-osd' or 'ps aux | grep ceph'; this CVE affects systems processing untrusted CRUSH maps
  3. Search kernel logs with 'dmesg | grep -i crush' or 'journalctl -k | grep crush' for messages indicating crush map decode failures or memory errors
  4. After patching, confirm the new kernel is loaded with 'uname -r' and verify no crush-related errors appear in 'dmesg' after reboot

FAQ

What is CVE-2026-52955?

This is a critical memory safety vulnerability in the Linux kernel's CRUSH map decoder that can be triggered when processing malformed CEPH_MSG_OSD_MAP messages containing mismatched bucket algorithm identifiers, leading to out-of-bounds memory access and potential remote code execution.

Is CVE-2026-52955 being actively exploited?

No, this CVE is not currently listed on the CISA Known Exploited Vulnerabilities catalog and no public exploits are available, though the critical severity warrants proactive patching.

What versions of Kernel are affected by CVE-2026-52955?

Linux kernel versions 6.19 through 7.0.9 are vulnerable; version 7.0.10 and later include the fix.

How do I check if my server is vulnerable to CVE-2026-52955?

Run 'uname -r' to display your kernel version; if it reports 6.19 through 7.0.9, your system is vulnerable and requires immediate kernel update and reboot.

Does Defensia detect CVE-2026-52955?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Linux kernel is installed on a monitored server, CVE-2026-52955 will appear in your dashboard with remediation steps.

Related Kernel CVEs

CVE-2026-63795CVSS 10In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9_client_walk() error path When p9_client_walk() is called with clone set to false, fid aliases oldfid. If the walk subsequently fails after the request has been sent, the error path jumps to clunk_fid, which currently calls p9_fid_put(fid) unconditionally. This drops a reference to oldfid even though ownership of oldfid remains with the caller. If this is the last reference, oldfid can be clunked and destroyed while the caller still expects it to be valid. A later use or put of oldfid can then trigger a use-after-free or refcount underflow. Fix this by only putting fid in the clunk_fid error path when it does not alias oldfid, matching the existing guard in the error path below. This can be triggered when a multi-component walk is split into multiple p9_client_walk() calls and a later non-cloning walk fails. A reproducer and refcount warning logs are available on request.
CVE-2026-53086CVSS 9.8In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix racing timeout handler The bcmgenet_timeout handler tries to take down all tx queues when a single queue times out. This is over zealous and causes many race conditions with queues that are still chugging along. Instead lets only restart the timed out queue.
CVE-2026-64113CVSS 9.8In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix use-after-free in VEPA multicast source pruning ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's own address (VEPA multicast workaround) by freeing the skb and continuing to the next descriptor: dev_kfree_skb_irq(skb); continue; The skb pointer is declared outside the while loop and persists across iterations. Because the continue skips the "skb = NULL" reset at the bottom of the loop, the next iteration enters the "else if (skb)" path and calls ixgbevf_add_rx_frag() on the freed skb, dereferencing skb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context. The sibling driver iavf already handles this correctly by nulling the pointer before continuing. Apply the same pattern here. I do not have ixgbevf hardware; the bug was found by static analysis (scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool corroboration with the highest score in the scan). The UAF was confirmed under KASAN by loading a test module that reproduces the exact code pattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags): BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000 Read of size 8 at addr 000000006163ae78 by task insmod/30 freed 208-byte region [000000006163adc0, 000000006163ae90) QEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF driver does not include the VEPA source pruning path, so a full end-to-end reproduction with emulated hardware was not possible.
CVE-2026-52993CVSS 9.8In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_buf_append() tipc_msg_validate() can potentially reallocate the skb it is validating, freeing the old one. In tipc_buf_append(), it was being called with a pointer to a local variable which was a copy of the caller's skb pointer. If the skb was reallocated and validation subsequently failed, the error handling path would free the original skb pointer, which had already been freed, leading to double-free. Fix this by checking if head now points to a newly allocated reassembled skb. If it does, reassign *headbuf for later freeing operations.
CVE-2026-53088CVSS 9.8In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb The write_ptr points to the next open tx_cb. We want to return the tx_cb that gets rewinded, so we must rewind the pointer first then return the tx_cb that it points to. That way the txcb can be correctly cleaned up.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-52955. Free for 1 server.

Get started free