Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-52954— libceph: handle rbtree insertion error in decode_choose_args()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于decode_choose_args()函数在rbtree插入操作中未正确处理错误，可能导致内核BUG。

CVSS 7.5 · High EPSS 0.52% · P42

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 5cf9c4a9959b6273675310d14a834ef14fbca37c< c7bf7864e2924fa5508ac270b0e9364bc13d5a6c affected
5cf9c4a9959b6273675310d14a834ef14fbca37c< f47430fc1f815e87406e2d3b4e476eff1bc7fd9b affected
5cf9c4a9959b6273675310d14a834ef14fbca37c< 0b6a3bcb91bc5bfeda39f0df3b71bab62c13e9da affected
5cf9c4a9959b6273675310d14a834ef14fbca37c< 534ebc08df97c47d4c7596f336fa31ecbf91519c affected
5cf9c4a9959b6273675310d14a834ef14fbca37c< 80c73bd1b2b04355d1d0c29be8ccbd25a380905d affected
5cf9c4a9959b6273675310d14a834ef14fbca37c< 4d2b37abda9536808655830d683dc491d31741a8 affected
5cf9c4a9959b6273675310d14a834ef14fbca37c< 0a1265a9ab875f92b6a3ffb497404f46cf9d76a3 affected
5cf9c4a9959b6273675310d14a834ef14fbca37c< d289478cfc0bcf81c7914200d6abdcb78bd04ded affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-52954

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
libceph: handle rbtree insertion error in decode_choose_args()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: libceph: handle rbtree insertion error in decode_choose_args() A message of type CEPH_MSG_OSD_MAP contains an OSD map that itself contains a CRUSH map. The received CRUSH map may optionally contain choose_args that get decoded in decode_choose_args(). In this function, num_choose_arg_maps is read from the message, and a corresponding number of crush_choose_arg_maps gets decoded afterwards. Each crush_choose_arg_map has a choose_args_index, which serves as the key when inserting it into the choose_args rbtree of the decoded crush_map. If a (potentially corrupted) message contains two crush_choose_arg_maps with the same index, the assertion in insert_choose_arg_map() triggers a kernel BUG when trying to insert the second crush_choose_arg_map. This patch fixes the issue by switching to the non-asserting rbtree insertion function and rejecting the message if the insertion fails. [ idryomov: changelog ]
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于decode_choose_args()函数在rbtree插入操作中未正确处理错误，可能导致内核BUG。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 5cf9c4a9959b6273675310d14a834ef14fbca37c ~ c7bf7864e2924fa5508ac270b0e9364bc13d5a6c -
Linux Linux 4.13 -

II. Public POCs for CVE-2026-52954

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-52954

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-52954 (8)

Same Patch Batch · Linux · 2026-06-24 · 219 CVEs total

CVE-2026-53049 9.8 CRITICAL gfs2: add some missing log locking
CVE-2026-52993 9.8 CRITICAL tipc: fix double-free in tipc_buf_append()
CVE-2026-52989 9.8 CRITICAL nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
CVE-2026-52986 9.8 CRITICAL netfilter: nf_conntrack_sip: don't use simple_strtoul
CVE-2026-52982 9.8 CRITICAL net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
CVE-2026-53002 9.8 CRITICAL netfilter: conntrack: remove sprintf usage
CVE-2026-53006 9.8 CRITICAL ipv6: fix possible UAF in icmpv6_rcv()
CVE-2026-53045 9.8 CRITICAL memory: tegra124-emc: Fix dll_change check
CVE-2026-53086 9.8 CRITICAL net: bcmgenet: fix racing timeout handler
CVE-2026-53046 9.8 CRITICAL ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine
CVE-2026-52955 9.8 CRITICAL libceph: Fix potential out-of-bounds access in crush_decode()
CVE-2026-53010 9.8 CRITICAL ksmbd: fix use-after-free in smb2_open during durable reconnect
CVE-2026-53088 9.8 CRITICAL net: bcmgenet: fix off-by-one in bcmgenet_put_txcb
CVE-2026-52914 9.8 CRITICAL batman-adv: fix fragment reassembly length accounting
CVE-2026-53055 9.8 CRITICAL crypto: hisilicon/sec2 - prevent req used-after-free for sec
CVE-2026-52924 9.8 CRITICAL sctp: purge outqueue on stale COOKIE-ECHO handling
CVE-2026-52931 9.8 CRITICAL batman-adv: tp_meter: avoid use of uninit sender vars
CVE-2026-52999 9.1 CRITICAL netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
CVE-2026-53043 9.1 CRITICAL ocfs2/dlm: validate qr_numregions in dlm_match_regions()
CVE-2026-52958 9.1 CRITICAL libceph: Fix potential out-of-bounds access in osdmap_decode()

Showing top 20 of 219 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-52954

No comments yet

Leave a comment