Log in Start free

Vulnerability · Published Jun 24, 2026 · Assigned by Linux

CVE-2026-52954libceph: handle rbtree insertion error in decode_choose_args()

High 7.5

In plain English

A high-severity improper input validation in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 55.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: libceph: handle rbtree insertion error in decode_choose_args() A message of type CEPH_MSG_OSD_MAP contains an OSD map that itself contains a CRUSH map. The received CRUSH map may optionally contain choose_args that get decoded in decode_choose_args(). In this function, num_choose_arg_maps is read from the message, and a corresponding number of crush_choose_arg_maps gets decoded afterwards. Each crush_choose_arg_map has a choose_args_index, which serves as the key when inserting it into the choose_args rbtree of the decoded crush_map. If a (potentially corrupted) message contains two crush_choose_arg_maps with the same index, the assertion in insert_choose_arg_map() triggers a kernel BUG when trying to insert the second crush_choose_arg_map. This patch fixes the issue by switching to the non-asserting rbtree insertion function and rejecting the message if the insertion fails. [ idryomov: changelog ]

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.176-1DEBIAN-CVE-2026-52954
Debian:13linux6.12.94-1DEBIAN-CVE-2026-52954
Debian:14linux7.0.10-1DEBIAN-CVE-2026-52954
Ubuntu:22.04:LTSlinux5.15.0-186.196UBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux6.8.0-136.136UBUNTU-CVE-2026-52954
Ubuntu:25.10linuxno fix listedUBUNTU-CVE-2026-52954
Ubuntu:26.04:LTSlinux7.0.0-28.28UBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-aws5.15.0-1112.119UBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-aws6.8.0-1061.64UBUNTU-CVE-2026-52954
Ubuntu:25.10linux-awsno fix listedUBUNTU-CVE-2026-52954
Ubuntu:26.04:LTSlinux-aws7.0.0-1009.9UBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-aws-6.14no fix listedUBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-aws-6.17no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1061.64~22.04.1UBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-azure5.15.0-1117.126UBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-azure6.8.0-1063.71UBUNTU-CVE-2026-52954
Ubuntu:25.10linux-azureno fix listedUBUNTU-CVE-2026-52954
Ubuntu:26.04:LTSlinux-azure7.0.0-1010.10UBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-azure-6.14no fix listedUBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-azure-6.17no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1063.71~22.04.1UBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-azure-7.07.0.0-1014.14~24.04.1UBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1117.126UBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-azure-fde6.8.0-1062.69UBUNTU-CVE-2026-52954
Ubuntu:25.10linux-azure-fdeno fix listedUBUNTU-CVE-2026-52954
Ubuntu:26.04:LTSlinux-azure-fde7.0.0-1009.9UBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-azure-fde-6.14no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-azure-fde-6.86.8.0-1062.69~22.04.1UBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-azure-fde-7.07.0.0-1013.13~24.04.1UBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-azure-nvidiano fix listedUBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-azure-nvidia-6.14no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-gcp5.15.0-1112.122UBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-gcp6.8.0-1064.72UBUNTU-CVE-2026-52954
Ubuntu:25.10linux-gcpno fix listedUBUNTU-CVE-2026-52954
Ubuntu:26.04:LTSlinux-gcp7.0.0-1008.8UBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-gcp-6.14no fix listedUBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-gcp-6.17no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1064.72~22.04.1UBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-gcp-7.07.0.0-1011.11~24.04.1UBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-gke5.15.0-1108.114UBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-gke6.8.0-1059.67UBUNTU-CVE-2026-52954
Ubuntu:26.04:LTSlinux-gke7.0.0-1003.4UBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1095.103UBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1046.50UBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-hwe-6.14no fix listedUBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-hwe-6.17no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-136.136~22.04.1UBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-hwe-7.07.0.0-28.28~24.04.1UBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-ibm5.15.0-1106.110UBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-ibm6.8.0-1061.62UBUNTU-CVE-2026-52954
Ubuntu:26.04:LTSlinux-ibm7.0.0-1010.10UBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1061.62~22.04.1UBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1107.113UBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-kvm5.15.0-1104.109UBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-184.194UBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-136.136.2UBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-136.136.2~22.04.1UBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1107.108UBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1059.62UBUNTU-CVE-2026-52954
Ubuntu:26.04:LTSlinux-nvidia7.0.0-1016.16UBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-nvidia-6.17no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1059.62~22.04.1UBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-nvidia-7.07.0.0-1016.16~24.04.1UBUNTU-CVE-2026-52954
Ubuntu:26.04:LTSlinux-nvidia-bos7.0.0-2016.16UBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1059.62.1UBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1064.66UBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-nvidia-tegra6.8.0-1030.31UBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1053.53UBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-oem-6.14no fix listedUBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-oem-6.17no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2026-52954
Ubuntu:26.04:LTSlinux-oem-7.07.0.0-1009.9UBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-oracle5.15.0-1109.115UBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-oracle6.8.0-1058.61UBUNTU-CVE-2026-52954
Ubuntu:25.10linux-oracleno fix listedUBUNTU-CVE-2026-52954
Ubuntu:26.04:LTSlinux-oracle7.0.0-1008.8UBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-oracle-6.14no fix listedUBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-oracle-6.17no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1058.61~22.04.1UBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-oracle-7.07.0.0-1011.11~24.04.1UBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-raspi5.15.0-1106.109UBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-raspi6.8.0-1061.65UBUNTU-CVE-2026-52954
Ubuntu:25.10linux-raspino fix listedUBUNTU-CVE-2026-52954
Ubuntu:26.04:LTSlinux-raspi7.0.0-1015.15UBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-52954
Ubuntu:25.10linux-realtimeno fix listedUBUNTU-CVE-2026-52954
Ubuntu:26.04:LTSlinux-realtime7.0.0-28.28.1UBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-52954
Ubuntu:25.10linux-riscvno fix listedUBUNTU-CVE-2026-52954
Ubuntu:26.04:LTSlinux-riscv7.0.0-28.28.1UBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-riscv-6.17no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-136.136~22.04.3UBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-riscv-7.07.0.0-28.28.1~24.04.3UBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-vmware6.8.0-1008.8UBUNTU-CVE-2026-52954
Ubuntu:24.04:LTSlinux-xilinx6.8.0-1033.34UBUNTU-CVE-2026-52954
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1075.79UBUNTU-CVE-2026-52954

Affected products (as reported)

VendorProductVersions
Linux Linux 5cf9c4a9959b6273675310d14a834ef14fbca37c – before c7bf7864e2924fa5508ac270b0e9364bc13d5a6c5cf9c4a9959b6273675310d14a834ef14fbca37c – before f47430fc1f815e87406e2d3b4e476eff1bc7fd9b5cf9c4a9959b6273675310d14a834ef14fbca37c – before 0b6a3bcb91bc5bfeda39f0df3b71bab62c13e9da5cf9c4a9959b6273675310d14a834ef14fbca37c – before 534ebc08df97c47d4c7596f336fa31ecbf91519c5cf9c4a9959b6273675310d14a834ef14fbca37c – before 80c73bd1b2b04355d1d0c29be8ccbd25a380905d5cf9c4a9959b6273675310d14a834ef14fbca37c – before 4d2b37abda9536808655830d683dc491d31741a85cf9c4a9959b6273675310d14a834ef14fbca37c – before 0a1265a9ab875f92b6a3ffb497404f46cf9d76a35cf9c4a9959b6273675310d14a834ef14fbca37c – before d289478cfc0bcf81c7914200d6abdcb78bd04ded
Linux Linux 4.13

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References