CVE-2026-52954

A flaw was found in the Linux kernel's libceph component. A remote attacker could send a specially crafted CEPH_MSG_OSD_MAP message containing a corrupted CRUSH map. If this map includes two crush_choose_arg_maps with identical indices, it triggers an assertion failure, leading to a kernel bug and a system crash. This vulnerability results in a denial of service (DoS).

A reachable assertion in libceph CRUSH map parsing can be triggered when a received CEPH_MSG_OSD_MAP contains duplicate choose_args_index values inside choose_args. The second insertion into the choose_args rbtree hits a kernel BUG instead of returning a normal parse error, causing a kernel crash and denial of service for a Ceph client. For the CVSS the PR:N because no local account on the victim is needed if the attacker can make the client accept a crafted OSD map from a malicious or compromised Ceph monitor or through a trusted cluster communication path. The issue is network reachable in Ceph deployments, but practical exploitation usually requires control of a Ceph cluster endpoint or the ability to tamper with authenticated cluster traffic. Impact is denial of service only, with no evidence of memory corruption, information disclosure, or privilege escalation from this patch context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.