CVE-2026-52957: Linux Kernel Ceph Null Pointer Dereference Denial of Service

Technical summary

The vulnerability exists in the decode_choose_args() function within libceph's CRUSH map decoding logic. CEPH_MSG_OSD_MAP messages contain CRUSH maps that are decoded in crush_decode(), which allocates an array of max_buckets entries. Some indices in this array legitimately remain NULL if they don't correspond to actual buckets. However, when decode_choose_args() processes optional choose_args structures from the incoming message, it reads a bucket_index and only validates that this index is less than max_buckets—it fails to verify that the bucket at that index is non-NULL. If a malicious or corrupted message contains a bucket_index pointing to a NULL entry, subsequent code attempting to dereference that bucket pointer triggers a null pointer dereference (CWE-476). The fix adds an additional NULL check before accessing the bucket, preventing the dereference.

Business impact

This vulnerability can cause kernel panic and system unavailability on any Linux system running vulnerable kernel versions that participate in a Ceph cluster. For organizations using Ceph for distributed storage, this represents a direct threat to service availability. An unauthenticated remote attacker on the network can trigger a denial of service by sending a crafted OSD map message, potentially disrupting access to Ceph-backed storage infrastructure. Recovery requires manual system restart, and widespread exploitation could compromise multiple cluster nodes.

Affected systems

The Linux kernel is affected across multiple versions. Systems that are particularly at risk include Ceph cluster nodes (OSD and monitor daemons), Ceph clients, and any Linux system with libceph enabled that communicates with a Ceph cluster. The vulnerability affects kernel versions prior to the patched release; consult the Linux kernel repository and your distribution's security advisories for specific affected version ranges.

Exploitability

Exploitation requires network access to a system running a vulnerable kernel with Ceph networking active, but requires no authentication or user interaction. The attack vector is network-based with low complexity—an attacker simply sends a malformed OSD map message with a crafted choose_args structure. The barrier to exploitation is low, making this vulnerability practically exploitable in production Ceph deployments accessible to untrusted networks. No exploit kit is required; the logic to construct such a message is straightforward.

Remediation

Apply kernel security patches from your Linux distribution that include the fix for decode_choose_args(). The patch adds a NULL pointer check before dereferencing bucket indices in choose_args decoding. If patching cannot be immediately deployed, consider network segmentation to restrict unauthenticated access to Ceph cluster communication ports, and monitor for abnormal Ceph node restarts that could indicate exploitation attempts.

Patch guidance

Contact your Linux distribution vendor for availability of patched kernel releases. Kernel updates addressing this vulnerability should be prioritized and tested in a staging environment before production deployment, as kernel updates typically require system restart. Verify the patch includes the NULL check validation in decode_choose_args() before applying.

Detection guidance

Monitor for repeated kernel crashes or panics in syslog on Ceph nodes, particularly those with unusual timing coinciding with network activity. System monitoring tools can alert on unexpected OSD or monitor daemon restarts. Network intrusion detection systems may flag malformed CEPH_MSG_OSD_MAP messages, though detection is challenging without protocol-level validation. Kernel audit logs may capture the null pointer dereference event before the system crashes.

Why prioritize this

CVE-2026-52957 merits immediate patching priority due to its CVSS 7.5 (HIGH) severity, unauthenticated network exploitability, and direct impact on system availability. Organizations running Ceph clusters should treat this as critical. The low attack complexity and high impact on confidentiality—potential service disruption—combined with the lack of user interaction requirement make this a high-priority remediation target, especially for systems exposed to untrusted networks.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible vulnerability with no authentication required and low complexity (AV:N/AC:L/PR:N). The impact is primarily availability (A:H)—the vulnerability causes denial of service through kernel crash. There is no direct confidentiality or integrity impact to data, but availability impact to the kernel itself is severe. The lack of user interaction (UI:N) and the fact that the attack affects the entire system (S:U) rather than an isolated component elevate the score.

Frequently asked questions