CyberSecBulletin
CVE-2026-52956NVD status: Modified

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-52956 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions c417b7d2d1c7fdc25af24490201320e36a3cc21d, 759053333a40c6997c2917dcd6160bfe40d2b42e, ebc7eddf6225b87e3aae720875f9dd40cb6b1cef as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.61% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to c417b7d2d1c7fdc25af24490201320e36a3cc21d or 759053333a40c6997c2917dcd6160bfe40d2b42e or ebc7eddf6225b87e3aae720875f9dd40cb6b1cef or 5df268406ef38d0f92547959296577c7077dacdc, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 4.10 or 7.0.10, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxe15fd0a11db00fc7f470a9fc804657ec3f6d04a5 up to, but not including, c417b7d2d1c7fdc25af24490201320e36a3cc21d; e15fd0a11db00fc7f470a9fc804657ec3f6d04a5 up to, but not including, 759053333a40c6997c2917dcd6160bfe40d2b42e; e15fd0a11db00fc7f470a9fc804657ec3f6d04a5 up to, but not including, ebc7eddf6225b87e3aae720875f9dd40cb6b1cef; e15fd0a11db00fc7f470a9fc804657ec3f6d04a5 up to, but not including, 5df268406ef38d0f92547959296577c7077dacdc; e15fd0a11db00fc7f470a9fc804657ec3f6d04a5 up to, but not including, c7e9b53aebe401970f1b5f5a01b4e021b18e8bb2; e15fd0a11db00fc7f470a9fc804657ec3f6d04a5 up to, but not including, 821365487aa58d06bda65c676ba215d506ba9768; 2982b9c92a66604ffb9fb2db54cf735133d1ef56; 4.9.6 up to, but not including, 4.10; and 1 more rangesc417b7d2d1c7fdc25af24490201320e36a3cc21d, 759053333a40c6997c2917dcd6160bfe40d2b42e, ebc7eddf6225b87e3aae720875f9dd40cb6b1cef, 5df268406ef38d0f92547959296577c7077dacdc, c7e9b53aebe401970f1b5f5a01b4e021b18e8bb2, 821365487aa58d06bda65c676ba215d506ba9768
LinuxLinux Kernel4.9.6 up to, but not including, 4.10; 4.10 up to, but not including, 7.0.10; 7.14.10, 7.0.10

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
NoneNo data is disclosed.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() In __ceph_x_decrypt(), a part of the buffer p is interpreted as a ceph_x_encrypt_header, and the magic field of this struct is accessed. This happens without any guarantee that the buffer is large enough to hold this struct. The function parameter ciphertext_len represents the length of the ciphertext to decrypt and is guaranteed to be at most the remaining size of the allocated buffer p. However, this value is not necessarily greater than sizeof(ceph_x_encrypt_header). E.g., a message frame of type FRAME_TAG_AUTH_REPLY_MORE, that is just as long to hold the ciphertext at its end with a ciphertext_len of 8 or less, can trigger an out-of-bounds memory access when accessing hdr->magic. This patch fixes the issue by adding a check to ensure that the decrypted plaintext in the buffer is large enough to represent at least the ceph_x_encrypt_header.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.