CyberSecBulletin
CVE-2026-52955NVD status: Modified

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-52955 is a critical-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 6e70ef53e818c53eab28d7b0026b7fd03dddaba5, ebe76d58a48a48031b98543d86c4cd30a825b622, 3f42508191e129ee6b5ea96578d5cab14f2a013a as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.38% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to 6e70ef53e818c53eab28d7b0026b7fd03dddaba5 or ebe76d58a48a48031b98543d86c4cd30a825b622 or 3f42508191e129ee6b5ea96578d5cab14f2a013a or ea0d42137f0c06da71e37ffc647aab4c5309599a, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.258 or 5.15.209 or 6.1.175 or 6.6.141, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxf24e9980eb860d8600cbe5ef3d2fd9295320d229 up to, but not including, 6e70ef53e818c53eab28d7b0026b7fd03dddaba5; f24e9980eb860d8600cbe5ef3d2fd9295320d229 up to, but not including, ebe76d58a48a48031b98543d86c4cd30a825b622; f24e9980eb860d8600cbe5ef3d2fd9295320d229 up to, but not including, 3f42508191e129ee6b5ea96578d5cab14f2a013a; f24e9980eb860d8600cbe5ef3d2fd9295320d229 up to, but not including, ea0d42137f0c06da71e37ffc647aab4c5309599a; f24e9980eb860d8600cbe5ef3d2fd9295320d229 up to, but not including, cceb10023e76bc89f3fe9238ebd0ccab0fc7c7c5; f24e9980eb860d8600cbe5ef3d2fd9295320d229 up to, but not including, 0f3604cbe4df14c5e58288ac9f57511e726a222d; f24e9980eb860d8600cbe5ef3d2fd9295320d229 up to, but not including, fb176a99e4c1a5a8448a83d83d3606203ba81faa; f24e9980eb860d8600cbe5ef3d2fd9295320d229 up to, but not including, 4c79fc2d598694bda845b46229c9d48b65042970; and 1 more ranges6e70ef53e818c53eab28d7b0026b7fd03dddaba5, ebe76d58a48a48031b98543d86c4cd30a825b622, 3f42508191e129ee6b5ea96578d5cab14f2a013a, ea0d42137f0c06da71e37ffc647aab4c5309599a, cceb10023e76bc89f3fe9238ebd0ccab0fc7c7c5, 0f3604cbe4df14c5e58288ac9f57511e726a222d
Red HatRed Hat Enterprise Linux 10Not specified in the recordNot stated
Red HatRed Hat Enterprise Linux 6Not specified in the recordNot stated
Red HatRed Hat Enterprise Linux 7Not specified in the recordNot stated
Red HatRed Hat Enterprise Linux 8Not specified in the recordNot stated
Red HatRed Hat Enterprise Linux 9Not specified in the recordNot stated
LinuxLinux Kernel2.6.34.1 up to, but not including, 5.10.258; 5.11 up to, but not including, 5.15.209; 5.16 up to, but not including, 6.1.175; 6.2 up to, but not including, 6.6.141; 6.7 up to, but not including, 6.12.91; 6.13 up to, but not including, 6.18.33; 6.19 up to, but not including, 7.0.10; 2.6.34; and 1 more ranges5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Scoring systemScoreSeverityScored by
CVSS 3.19.8CriticalCNA
CVSS 3.14.7MediumCNA

Official description

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in crush_decode() A message of type CEPH_MSG_OSD_MAP containing a crush map with at least one bucket has two fields holding the bucket algorithm. If the values in these two fields differ, an out-of-bounds access can occur. This is the case because the first algorithm field (alg) is used to allocate the correct amount of memory for a bucket of this type, while the second algorithm field inside the bucket (b->alg) is used in the subsequent processing. This patch fixes the issue by adding a check that compares alg and b->alg and aborts the processing in case they differ. Furthermore, b->alg is set to 0 in this case, because the destruction of the crush map also uses this field to determine the bucket type, which can again result in an out-of-bounds access when trying to free the memory pointed to by the fields of the bucket. To correctly free the memory allocated for the bucket in such a case, the corresponding call to kfree is moved from the algorithm-specific crush_destroy_bucket functions to the generic crush_destroy_bucket().

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.