CVE-2026-52954: Linux Kernel Ceph Client Denial of Service via Malformed OSD Map

Technical summary

CVE-2026-52954 affects the libceph subsystem in the Linux kernel, specifically the decode_choose_args() function which parses CEPH_MSG_OSD_MAP messages. These messages contain cluster state including a CRUSH map used for data placement. The vulnerability stems from an assertion-based guard in insert_choose_arg_map() that does not gracefully handle rbtree insertion failures. When two crush_choose_arg_maps share the same index (via message corruption or malice), the second insertion triggers a kernel BUG assertion, causing an immediate system crash. The fix replaces the assertion-based insertion with proper error checking and message rejection, allowing the kernel to discard malformed input rather than panic.

Business impact

For organizations operating Ceph-based storage infrastructure or using the Ceph client on production systems, this vulnerability enables any network-capable attacker to remotely crash kernel processes. This disrupts service availability, may trigger cascading failures in storage-dependent applications, and complicates disaster recovery if multiple systems are impacted simultaneously. Systems relying on Ceph for persistent storage or running containerized workloads that use Ceph volumes face particular risk. The lack of privilege requirement and network accessibility make this a significant threat in multi-tenant or untrusted network environments.

Affected systems

The Linux kernel in versions that include the vulnerable libceph code is affected. Any system running a vulnerable kernel with Ceph client functionality enabled—including Kubernetes nodes using Ceph for persistent volumes, OpenStack deployments with Ceph backend storage, and standalone Ceph cluster nodes—is at risk. The vulnerability is triggered during normal OSD map update processing, so any system actively participating in or connecting to a Ceph cluster may encounter the malicious message.

Exploitability

Exploitation is straightforward and requires only network access to send a crafted CEPH_MSG_OSD_MAP message to a vulnerable kernel. No authentication or special privileges are needed on the target system. The attack is reliable—a properly formed message with duplicate choose_args indices will consistently trigger the crash. However, the attacker must have network visibility to the Ceph cluster communication channel or be able to intercept and modify legitimate cluster messages. In isolated or properly access-controlled Ceph deployments, risk is reduced; in cloud environments or shared infrastructure, exposure is higher.

Remediation

Apply a kernel update that includes the fix for decode_choose_args() error handling. The patch replaces the assertion-based rbtree insertion with a non-asserting variant and validates insertion success, rejecting malformed OSD maps gracefully. Verify the specific patched kernel version against your Linux distribution's advisory. As an interim measure, restrict network access to Ceph cluster communication channels and consider disabling Ceph client functionality on systems not actively using it. Monitor for unexpected kernel crashes on systems running Ceph.

Patch guidance

Check your Linux distribution's security advisory for the patched kernel version addressing libceph error handling. Kernel maintainers have resolved this by switching from assertion-based to error-checked rbtree insertion. After patching, verify the change is present using the distribution's changelog or by confirming kernel version and code inspection. Test the patch in a staging environment that mirrors production Ceph topology before broad rollout, as kernel updates may require reboot and should be coordinated with maintenance windows. Monitor affected systems post-patch for stability.

Detection guidance

Monitor kernel logs (dmesg, journalctl) for BUG_ON() assertions or kernel panics originating from libceph code paths, specifically decode_choose_args() or insert_choose_arg_map(). Capture kernel dumps and examine stack traces mentioning ceph_osd_op_map, CRUSH, or choose_args. Network-level detection is difficult without packet inspection deep into Ceph protocol messages, but unexpected Ceph client crashes or OSD map update failures are indicators. Implement anomaly detection on system uptime to flag unexpected reboots on Ceph-participating hosts.

Why prioritize this

This vulnerability scores 7.5 (HIGH) due to high network accessibility, low attack complexity, and guaranteed availability impact. While it does not leak data or enable privilege escalation, the ability to remotely crash production infrastructure with a single malformed message makes it a priority for any organization using Ceph. The lack of privilege or authentication requirements and the simplicity of exploitation elevate urgency. Systems in untrusted network zones or multi-tenant environments should be prioritized.

Risk score, explained

CVSS 3.1 score of 7.5 reflects the following: Network-based attack vector (AV:N) with low attack complexity (AC:L) and no privilege or user interaction required (PR:N/UI:N) yield a base score of 8.6; however, the impact is limited to availability (A:H, C:N, I:N), reducing the final score to 7.5. The scope is unchanged (S:U). This rating appropriately reflects a serious but narrowly-scoped denial-of-service threat that does not compromise confidentiality or integrity.

Frequently asked questions