CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode()

Synopsis

An out-of-bounds memory access vulnerability exists in the Linux kernel's libceph component, specifically in the crush_decode() function that parses CRUSH map messages received over the network. A remote, unauthenticated attacker can send a crafted CEPH_MSG_OSD_MAP message containing a CRUSH map bucket with mismatched algorithm fields, triggering the out-of-bounds access. Successful exploitation gives the attacker full read, write, and crash capability over the affected system. Patched-image rebuilds at the fixed kernel versions (5.10.258 and 5.15.209) are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Ceph OSD messaging service over the network; the vulnerability is exposed to any host that can send a CEPH_MSG_OSD_MAP message to the target.

• AuthenticationNot required

  No credentials or account are needed; the crafted CRUSH map message can be sent without authenticating to the target.

• Victim interactionNot required

  No user action is needed; the kernel processes the incoming OSD map message automatically without any interaction from a logged-in user.

• Attack complexityDetail

  The exploit is reliable and condition-free; crafting a CRUSH map bucket with mismatched algorithm fields is a straightforward message construction with no race conditions or environmental dependencies.

Blast Radius

• Reads arbitrary kernel memory, exposing sensitive data such as cryptographic keys, session tokens, and in-memory credentials.
• Writes to arbitrary kernel memory locations, allowing modification of kernel data structures, security policies, or persisted data.
• Crashes the affected kernel, taking down all workloads and services running on the host.
• Provides a primitive for local privilege escalation or container escape in environments where Ceph client functionality is active inside a container.