CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode()

Synopsis

An out-of-bounds memory read and write vulnerability exists in the Linux kernel's libceph subsystem, specifically inside the osdmap_decode() function used to parse incoming OSD map messages from a Ceph cluster. The flaw is reachable over the network with no authentication required, because a remote attacker or a compromised Ceph monitor can send a crafted osdmap message with an inflated max_osd value that causes the kernel to read or write past the end of an allocated buffer. Successful exploitation leaks kernel memory contents and can crash the affected host. A patched-image rebuild at the fix commits is available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable parsing code is triggered by an incoming osdmap message, so an attacker must be able to reach the Ceph messaging endpoint over the network to deliver a crafted message.

• AuthenticationNot required

  The CVSS vector specifies PR:N, meaning no credentials or account privileges are needed to send a message that triggers the vulnerable code path.

• Victim interactionNot required

  The CVSS vector specifies UI:N, so no user action is required; the kernel processes the malicious message automatically upon receipt.

• Attack complexityDetail

  The CVSS vector specifies AC:L, meaning the exploit is reliable and requires no special environmental conditions, race windows, or memory-layout knowledge.

Blast Radius

• An attacker who can send a crafted osdmap message reads regions of kernel memory beyond the allocated osd_weight buffer, potentially exposing kernel pointers, cryptographic material, or data from adjacent allocations.
• The out-of-bounds access can corrupt kernel heap memory, crashing the host or destabilizing the kernel's Ceph client subsystem, denying storage access to all workloads on that node.
• A crashed or destabilized Ceph client node loses connectivity to its Ceph cluster, making any persistent volumes backed by that cluster unavailable to running containers on the host.