CVE-2026-52958: linux Out-of-bounds Read
Vulnerability summary
CVE-2026-52958 is a critical (CVSS 9.1) Out-of-bounds Read vulnerability in linux. EPSS estimates a 0.73% chance of exploitation in the next 30 days, higher than 53.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 64 · Related 63Timeline
- 24-06-2026PublishedVulnerability first disclosed.
- 19-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in osdmap_decode() When decoding osd_state and osd_weight from an incoming osdmap in osdmap_decode(), both are decoded for each osd, i.e., map->max_osd times. The ceph_decode_need() check only accounts for sizeof(*map->osd_weight) once. This can potentially result in an out-of-bounds memory access if the incoming message is corrupted such that the max_osd value exceeds the actual content of the osdmap message. This patch fixes the issue by changing the corresponding part in the ceph_decode_need() check to account for map->max_osd*sizeof(*map->osd_weight).
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- NVDNIST9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS trend
Probability
0.73%
Chance of exploitation in the next 30 days
Percentile
54%
Versus all other CVEs
30-day change
+0.20 pp
From 0.54% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu162 products
- linux< 5.4.0-234.254 | < 5.15.0-186.196 | < 6.8.0-136.136 | All versions (No fix recorded) | < 7.0.0-28.28
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 5.4.0-1162.173 | < 5.15.0-1112.119 | < 6.8.0-1061.64 | All versions (No fix recorded) | < 7.0.0-1009.9
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ dcbc919a5dc8c2629684a113a90c0b6fe10c3462, < 36a79759a288961b1ff28a68ec2d1f56f6848098 | ≥ dcbc919a5dc8c2629684a113a90c0b6fe10c3462, < 3f2575bb7f955d42569d96c3e04fa958a0dcf4b4 | ≥ dcbc919a5dc8c2629684a113a90c0b6fe10c3462, < 8713bbc4b2b9ad78f803978e54b7e49dd21bd9be | ≥ dcbc919a5dc8c2629684a113a90c0b6fe10c3462, < 0d2dd7e6bb74fd7712aa73457a4a821906c6863a | ≥ dcbc919a5dc8c2629684a113a90c0b6fe10c3462, < e7187f33c02488697ec0d01d82bf7a3f8deaba8f | ≥ dcbc919a5dc8c2629684a113a90c0b6fe10c3462, < 48df98d12b15360cd56af5c1f460307b340c1197 | ≥ dcbc919a5dc8c2629684a113a90c0b6fe10c3462, < ee933694645dac062d65fc2743f92bc06fa0db6b | ≥ dcbc919a5dc8c2629684a113a90c0b6fe10c3462, < 35d0ed82d03e5ee77ea4f31f20e29562a7721649 | 5.3
- linux_kernel≥ 5.3, < 5.10.258 | ≥ 5.11, < 5.15.209 | ≥ 5.16, < 6.1.175 | ≥ 6.2, < 6.6.141 | ≥ 6.7, < 6.12.91 | ≥ 6.13, < 6.18.33 | ≥ 6.19, < 7.0.10 | 7.1:rc1 | 7.1:rc2 | 7.1:rc3
Debian1 product
- linux< 6.1.176-1 | < 6.12.94-1 | < 7.0.10-1
3 vendors · 165 products
