🔴 严重 | CVE-2026-52955 — In the Linux kernel, the following vulnerability has be
🔴 《严重安全漏洞：CVE-2026-52955》
CVSS 评分: 严重（9.8） CVE ID: CVE-2026-52955
漏洞描述
In the Linux kernel, the following vulnerability has been resolved:
libceph: Fix potential out-of-bounds access in crush_decode()
A message of type CEPH_MSG_OSD_MAP containing a crush map with at least
one bucket has two fields holding the bucket algorithm. If the values
in these two fields differ, an out-of-bounds access can occur. This is
the case because the first algorithm field (alg) is used to allocate
the correct amount of memory for a bucket of this type, while the second
algorithm field inside the bucket (b->alg) is used in the subsequent
processing.
This patch fixes the issue by adding a check that compares alg and
b->alg and aborts the processing in case they differ. Furthermore,
b->alg is set to 0 in this case, because the destruction of the crush
map also uses this field to determine the bucket type, which can again
result in an out-of-bounds access when trying to free the memory pointed
to by the fields of the bucket. To correctly free the memory allocated
for the bucket in such a case, the corresponding call to kfree is moved
from the algorithm-specific crush_destroy_bucket functions to the
generic crush_destroy_bucket().
| 字段 | 值 |
|---|---|
| CVE ID | CVE-2026-52955 |
| CVSS 评分 | 9.8 |
| 严重程度 | 严重 |
| 发布时间 | 2026-06-24 |
| 状态 | Received |
数据来源: NVD | 获取时间: 2026-06-28 18:14