CVE-2026-52957

A flaw was found in the Linux kernel's libceph component. When processing a CEPH_MSG_OSD_MAP message containing a specially crafted CRUSH map, a remote attacker could potentially trigger a null pointer dereference. This issue arises during the decoding of crush_choose_arg_map if a bucket_index refers to a non-existent bucket. Successful exploitation of this vulnerability could lead to a system crash, resulting in a Denial of Service (DoS).

Moderate severity is assigned to this flaw because exploitation requires a system to actively communicate with a Ceph cluster where an attacker can supply an invalid CRUSH map, limiting the blast radius to a denial of service via a kernel crash. In standard Red Hat Enterprise Linux installations, the libceph module is not loaded by default unless CephFS or kernel RBD volumes are explicitly configured. Consequently, environments that do not interact with untrusted or compromised Ceph storage clusters are not exposed to this risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.