CVE-2026-52958
Publication date 24 June 2026
Last updated 9 October 2026
Ubuntu priority
Description
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in osdmap_decode() When decoding osd_state and osd_weight from an incoming osdmap in osdmap_decode(), both are decoded for each osd, i.e., map->max_osd times. The ceph_decode_need() check only accounts for sizeof(*map->osd_weight) once. This can potentially result in an out-of-bounds memory access if the incoming message is corrupted such that the max_osd value exceeds the actual content of the osdmap message. This patch fixes the issue by changing the corresponding part in the ceph_decode_need() check to account for map->max_osd*sizeof(*map->osd_weight).
Why is this CVE high priority?
See ubuntu cvss score
Patch details
| Package | Patch details |
|---|
Severity score breakdown
CVSS version:
Base score
8.2 · High
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Base score
9.1 · Critical
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
References
Related Ubuntu Security Notices (USN)
- USN-8566-1
- Linux kernel vulnerabilities
- 20 July 2026
- USN-8567-1
- Linux kernel vulnerabilities
- 20 July 2026
- USN-8568-1
- Linux kernel (OEM) vulnerabilities
- 20 July 2026
- USN-8569-1
- Linux kernel (HWE) vulnerabilities
- 20 July 2026
- USN-8574-1
- Linux kernel (GCP FIPS) vulnerabilities
- 21 July 2026
- USN-8575-1
- Linux kernel vulnerabilities
- 21 July 2026
- USN-8576-1
- Linux kernel (NVIDIA Tegra) vulnerabilities
- 21 July 2026
- USN-8593-1
- Linux kernel vulnerabilities
- 23 July 2026
- USN-8574-2
- Linux kernel vulnerabilities
- 23 July 2026
- USN-8595-1
- Linux kernel (Oracle) vulnerabilities
- 23 July 2026
- USN-8596-1
- Linux kernel (NVIDIA) vulnerabilities
- 23 July 2026
- USN-8575-2
- Linux kernel vulnerabilities
- 23 July 2026
- USN-8576-2
- Linux kernel (NVIDIA Tegra) vulnerabilities
- 23 July 2026
- USN-8603-1
- Linux kernel (Azure) vulnerabilities
- 24 July 2026
- USN-8595-2
- Linux kernel (AWS) vulnerabilities
- 24 July 2026
- USN-8606-1
- Linux kernel (Azure) vulnerabilities
- 24 July 2026
- USN-8607-1
- Linux kernel (Azure CVM) vulnerabilities
- 24 July 2026
- USN-8608-1
- Linux kernel (Azure FIPS) vulnerabilities
- 24 July 2026
- USN-8609-1
- Linux kernel (Azure CVM) vulnerabilities
- 24 July 2026
- USN-8575-3
- Linux kernel vulnerabilities
- 24 July 2026
- USN-8610-1
- Linux kernel (Azure CVM) vulnerabilities
- 24 July 2026
- USN-8665-1
- Linux kernel (Raspberry Pi) vulnerabilities
- 20 August 2026
- USN-8618-1
- Linux kernel vulnerabilities
- 28 July 2026
- USN-8595-3
- Linux kernel (AWS) vulnerabilities
- 28 July 2026
- USN-8574-3
- Linux kernel vulnerabilities
- 28 July 2026
- USN-8619-1
- Linux kernel (HWE) vulnerabilities
- 28 July 2026
- USN-8620-1
- Linux kernel vulnerabilities
- 28 July 2026
- USN-8620-2
- Linux kernel (Azure FIPS) vulnerabilities
- 29 July 2026
- USN-8620-3
- Linux kernel (Intel IoTG) vulnerabilities
- 31 July 2026
- USN-8620-4
- Linux kernel (Intel IoTG) vulnerabilities
- 31 July 2026
- USN-8668-1
- Linux kernel (GCP) vulnerabilities
- 21 August 2026
- USN-8666-1
- Linux kernel vulnerabilities
- 20 August 2026
- USN-8663-1
- Linux kernel (NVIDIA) vulnerabilities
- 20 August 2026
- USN-8664-1
- Linux kernel (NVIDIA BaseOS) vulnerabilities
- 20 August 2026
- USN-8667-1
- Linux kernel (KVM) vulnerabilities
- 21 August 2026
- USN-8666-2
- Linux kernel (Azure) vulnerabilities
- 25 August 2026
- USN-8666-3
- Linux kernel (GCP FIPS) vulnerabilities
- 27 August 2026
- USN-8715-1
- Linux kernel (Oracle) vulnerabilities
- 2 September 2026
- USN-8728-1
- Linux kernel (GCP) vulnerabilities
- 7 September 2026
- USN-8748-1
- Linux kernel (NVIDIA) vulnerabilities
- 10 September 2026
- USN-8715-2
- Linux kernel (AWS FIPS) vulnerabilities
- 18 September 2026
- USN-8668-2
- Linux kernel (Raspberry Pi) vulnerabilities
- 21 September 2026
- USN-8728-2
- Linux kernel (Azure) vulnerabilities
- 22 September 2026
- USN-8728-3
- Linux kernel (Oracle) vulnerabilities
- 29 September 2026
- LSN-0122-1
- Kernel Live Patch Security Notice
- 7 October 2026
- USN-8911-1
- Linux kernel (OEM) vulnerabilities
- 9 October 2026