CVE-2026-52956 Details

A potential out-of-bounds access vulnerability has been identified in the Linux kernel's libceph component, specifically within the __ceph_x_decrypt() function. This issue arises because a portion of the buffer is interpreted as a ceph_x_encrypt_header, allowing access to the magic field of the struct without ensuring that the buffer is sufficiently large to accommodate it. Although the ciphertext_len parameter, which indicates the length of the ciphertext to be decrypted, is guaranteed to be no more than the remaining size of the allocated buffer, it may not exceed the size of the ceph_x_encrypt_header. For instance, a message frame of type FRAME_TAG_AUTH_REPLY_MORE, which is just long enough to hold the ciphertext with a length of 8 or less, can cause an out-of-bounds memory access when the magic field is accessed. This vulnerability has been addressed by adding a check to ensure that the decrypted plaintext is large enough to include at least the ceph_x_encrypt_header.

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been patched. Instructions for downloading the updated kernel can be found on the official Linux kernel website.