Skip to main content

Linux Kernel EUVDEUVD-2026-38824

| CVE-2026-52956 HIGH
Out-of-bounds Read (CWE-125)
2026-06-24 Linux GHSA-wvxf-4p9h-5vg9
Buffer Overflow Information Disclosure Linux
7.5
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Position as Ceph peer or MITM handshake
  2. Delivery
    Send crafted AUTH_REPLY_MORE frame (ciphertext_len ≤ 8)
  3. Exploit
    __ceph_x_decrypt reads hdr->magic out-of-bounds
  4. Execution
    Kernel out-of-bounds access faults
  5. Impact
    Client node crashes (denial of service)

Vulnerability Assessment

Weakness
CWE
CWE-125
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK

1 technique across 1 tactic: Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the target Linux host to be running the in-kernel Ceph client (RBD or CephFS via libceph) and to engage the CephX v2 messenger authentication exchange with an attacker-controlled, compromised, or man-in-the-middle Ceph peer. The specific trigger is a FRAME_TAG_AUTH_REPLY_MORE frame whose ciphertext_len is 8 bytes or less - too small to contain a full ceph_x_encrypt_header - causing the out-of-bounds read of hdr->magic. Although the CVSS marks PR:N/UI:N, exploitation is meaningfully limited to deployments that actually use kernel Ceph clients and to attackers able to feed crafted auth-reply frames into that handshake; hosts without the ceph/libceph modules loaded are not exposed.
Impact

The signals point to a genuine but moderate, availability-only risk rather than a top-priority emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates a network-reachable, low-complexity, unauthenticated trigger with high availability impact and no confidentiality or integrity loss - i.e., a remote crash/DoS, not code execution or data theft. This aligns with the description: an out-of-bounds read while accessing hdr->magic typically faults the kernel rather than leaking usable data. EPSS is low (0.16%, 6th percentile), there is no KEV listing and no public PoC, and exploitation requires the victim to be acting as a Ceph client connecting to an attacker-controlled or compromised Ceph peer/monitor - so the AV:N rating is technically correct but practically constrained to environments running kernel Ceph (RBD/CephFS). No SSVC decision data was provided. One caveat: the vector marks PR:N/AC:L, but real-world reachability depends on the host being configured as a Ceph client and initiating/continuing an authentication exchange with the malicious peer, which narrows the realistic attacker population.
Exploit ScenarioDerived

An attacker who controls or has compromised a Ceph peer (or can man-in-the-middle the v2 messenger handshake) sends a crafted FRAME_TAG_AUTH_REPLY_MORE frame with a ciphertext_len of 8 bytes or fewer to a Linux host acting as a Ceph client. When __ceph_x_decrypt() reads hdr->magic past the end of the undersized buffer, the kernel performs an out-of-bounds access and crashes, denying service to the affected node. No public exploit code has been identified, and the low complexity (AC:L) means a working trigger would be straightforward for an attacker already positioned as a Ceph peer.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 28, 2026

Denial of service in the Linux kernel's libceph (Ceph client) component allows a malicious or compromised Ceph peer to crash a connecting host during the CephX authentication handshake. The flaw lives in __ceph_x_decrypt(), which reads a ceph_x_encrypt_header (notably hdr->magic) from a decrypted buffer without first verifying the buffer is large enough - a FRAME_TAG_AUTH_REPLY_MORE frame carrying a ciphertext_len of 8 or fewer bytes triggers an out-of-bounds memory access. CVSS is 7.5 (availability-only); EPSS is low at 0.16% (6th percentile), there is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

RemediationAI

Vendor-released patch: update to Linux kernel 7.0.10 or 7.1 (or later), which add the length check ensuring the decrypted plaintext is at least sizeof(ceph_x_encrypt_header) before the header is dereferenced; the upstream fixes are commits c7e9b53aebe401970f1b5f5a01b4e021b18e8bb2 and 821365487aa58d06bda65c676ba215d506ba9768 (https://git.kernel.org/stable/c/c7e9b53aebe401970f1b5f5a01b4e021b18e8bb2 and https://git.kernel.org/stable/c/821365487aa58d06bda65c676ba215d506ba9768). Apply your distribution's kernel update containing these commits and reboot. Where immediate patching is not possible, reduce exposure by ensuring kernel Ceph clients only connect to trusted, authenticated Ceph monitors/OSDs over a segmented storage network and by restricting which peers can reach the client's messenger ports - note this does not fix the bug and offers no protection if the trusted Ceph cluster itself is compromised. If the host does not require kernel Ceph access, unloading/blacklisting the ceph and libceph modules eliminates the attack surface entirely, at the cost of losing RBD/CephFS kernel-client functionality.

Affected VersionsENISA

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <c7e9b53aebe401970f1b5f5a01b4e021b18e8bb2
Linux 0 <7.0.10
Linux patch: 7.0.10
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <821365487aa58d06bda65c676ba215d506ba9768
Linux patch: 7.1

Affected Packages

euvd linux fix: 7.0.10

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libceph is the in-kernel client library that implements the Ceph distributed-storage messaging and CephX authentication protocol used by the kernel RBD (block device) and CephFS clients. During the v2 messenger authentication exchange, __ceph_x_decrypt() decrypts an incoming frame and then casts the start of the plaintext buffer to a struct ceph_x_encrypt_header to validate its magic field. The root cause is a classic out-of-bounds read (CWE-125-class, consistent with the 'Buffer Overflow' tag) caused by a missing length check: ciphertext_len is bounded only by the remaining allocation size of buffer p, not by sizeof(ceph_x_encrypt_header), so a short AUTH_REPLY_MORE frame lets the struct field access run past valid data. The CPE data scopes this to the linux:linux kernel (cpe:2.3:a:linux:linux:*), and the fix adds a guard ensuring the decrypted plaintext is at least the size of the header struct.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Network-reachable Ceph handshake with no auth (AV:N/PR:N/UI:N); out-of-bounds read crashes the kernel, yielding availability-only impact (C:N/I:N/A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.0 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.5 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:28 cve.org
HIGH 7.5
CVE Published
Jun 24, 2026 - 16:28 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()

In __ceph_x_decrypt(), a part of the buffer p is interpreted as a ceph_x_encrypt_header, and the magic field of this struct is accessed. This happens without any guarantee that the buffer is large enough to hold this struct. The function parameter ciphertext_len represents the length of the ciphertext to decrypt and is guaranteed to be at most the remaining size of the allocated buffer p. However, this value is not necessarily greater than sizeof(ceph_x_encrypt_header). E.g., a message frame of type FRAME_TAG_AUTH_REPLY_MORE, that is just as long to hold the ciphertext at its end with a ciphertext_len of 8 or less, can trigger an out-of-bounds memory access when accessing hdr->magic.

This patch fixes the issue by adding a check to ensure that the decrypted plaintext in the buffer is large enough to represent at least the ceph_x_encrypt_header.

Executive ViewAI

Why It Matters

This HIGH-severity vulnerability affects Linux systems running Ceph client software, potentially allowing denial-of-service attacks on storage infrastructure from within the Ceph peer network. No public exploit has been identified at time of analysis, and the attack requires network positioning within the cluster with minimal real-world exploitation risk. Organizations using Ceph should plan patching within 30 days; others can safely deprioritize.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Ubiquitous
Linux kernel is everywhere; vulnerable libceph path limited to Ceph-client hosts
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Medium

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.177 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.155 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.206 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.152 Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-52956 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/373314 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3130/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3156/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3166/ REF https://git.kernel.org/stable/c/5df268406ef38d0f92547959296577c7077dacdc REF https://git.kernel.org/stable/c/759053333a40c6997c2917dcd6160bfe40d2b42e REF https://git.kernel.org/stable/c/821365487aa58d06bda65c676ba215d506ba9768 REF https://git.kernel.org/stable/c/c417b7d2d1c7fdc25af24490201320e36a3cc21d REF https://git.kernel.org/stable/c/c7e9b53aebe401970f1b5f5a01b4e021b18e8bb2 REF https://git.kernel.org/stable/c/ebc7eddf6225b87e3aae720875f9dd40cb6b1cef

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy