CVE-2026-52954: libceph: handle rbtree insertion error in decode_choose_args()
In the Linux kernel, the following vulnerability has been resolved:
libceph: handle rbtree insertion error in decodechooseargs()
A message of type CEPHMSGOSDMAP contains an OSD map that itself contains a CRUSH map. The received CRUSH map may optionally contain chooseargs that get decoded in decodechooseargs(). In this function, numchooseargmaps is read from the message, and a corresponding number of crushchooseargmaps gets decoded afterwards. Each crushchooseargmap has a chooseargsindex, which serves as the key when inserting it into the chooseargs rbtree of the decoded crushmap. If a (potentially corrupted) message contains two crushchooseargmaps with the same index, the assertion in insertchooseargmap() triggers a kernel BUG when trying to insert the second crushchooseargmap.
This patch fixes the issue by switching to the non-asserting rbtree insertion function and rejecting the message if the insertion fails.
[ idryomov: changelog ]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch idryomov
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52954?
CVE-2026-52954 has a risk rating of 50, indicating a moderate severity level.
How do I fix CVE-2026-52954?
To resolve CVE-2026-52954, you should update your Linux kernel to the latest patched version provided by your distribution.
What components are affected by CVE-2026-52954?
CVE-2026-52954 affects the Linux kernel, specifically the libceph implementation.
What type of vulnerability is CVE-2026-52954?
CVE-2026-52954 is an error handling vulnerability related to rbtree insertion within the decode_choose_args() function.
Is CVE-2026-52954 exploitable remotely?
Yes, CVE-2026-52954 has the potential to be exploited remotely via specially crafted CEPH_MSG_OSD_MAP messages.