CVE-2026-52956

A flaw was found in the Linux kernel's libceph module. A remote attacker could trigger an out-of-bounds memory access in the __ceph_x_decrypt() function by sending a specially crafted message frame of type FRAME_TAG_AUTH_REPLY_MORE with a small ciphertext length. This vulnerability arises because the function interprets a buffer as a ceph_x_encrypt_header without ensuring the buffer is large enough. Successful exploitation could lead to a denial of service or other unpredictable system behavior.

An out-of-bounds read in the CephX decrypt path can occur because __ceph_x_decrypt() reads hdr magic from a decrypted buffer before verifying that the plaintext is large enough to contain a ceph_x_encrypt_header. A malicious or compromised Ceph monitor endpoint can trigger this by returning a short authentication payload such as a short FRAME_TAG_AUTH_REPLY_MORE ciphertext. For the CVSS the PR:N is used because no privileges are required on the victim host beyond network reachability to the Ceph authentication peer. The issue is network reachable in deployments where an attacker can act as the Ceph monitor or tamper with monitor traffic. Impact is at least denial of service via kernel crash. The paranoid score keeps limited confidentiality impact because the primitive is an invalid kernel read, but no arbitrary write or direct privilege escalation primitive is shown.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.