CVE-2026-52957

What it actually does

This is a denial-of-service vulnerability in the Linux kernel Ceph client code, specifically in libceph CRUSH map decoding. A crafted or corrupted CEPH_MSG_OSD_MAP message can include choose_args that reference a bucket index that is within the declared max_buckets range but corresponds to a NULL bucket entry. The vulnerable decode_choose_args() path may then dereference that NULL bucket pointer, causing a kernel NULL pointer dereference. Depending on kernel configuration and runtime behavior, this can produce a kernel oops, crash the Ceph client workload, hang storage access, or panic/reboot the host.

Why it matters to the business

Systems that rely on the Linux kernel Ceph client for CephFS, RBD, or other Ceph-backed storage could experience sudden storage outages or host instability if they process a malicious or malformed OSD map. The practical impact is service interruption: applications may lose access to storage, nodes may reboot, and clustered services may fail over or degrade. The currently provided risk signals indicate low observed exploitation likelihood: EPSS is low at 0.00523, there is no known CISA KEV listing, no ransomware association is reported, and no public exploit maturity is indicated. However, storage-plane denial of service can still be operationally significant in environments where Ceph-backed storage is critical.

How an attack unfolds

An attacker needs a way to cause a vulnerable Linux kernel Ceph client to process a crafted or corrupted Ceph OSD map message. In realistic scenarios, that generally means the attacker can influence Ceph control-plane traffic, compromise or impersonate a Ceph monitor or other trusted Ceph component, abuse weak Ceph authentication or network segmentation, or perform a privileged man-in-the-middle attack against Ceph protocol traffic. The malicious CEPH_MSG_OSD_MAP contains a CRUSH map with a choose_args structure that references a bucket_index that passes the numeric bounds check but points to an array entry where no bucket exists. When the client decodes and later processes the map, the kernel attempts to access the NULL bucket pointer, triggering a NULL pointer dereference. The result is denial of service against the client node or its Ceph-backed storage access rather than direct code execution.

How to fix it

Upgrade the Linux kernel to a vendor release that includes the libceph fix for decode_choose_args(), which validates that the referenced CRUSH bucket exists before it is accessed. No exact fixed package versions were provided, so use the fixed kernel versions from the relevant Linux distribution, appliance vendor, or kernel stable branch advisory. Prioritize hosts that mount CephFS, use RBD through the kernel client, or otherwise load and use libceph. If immediate patching is not possible, reduce exposure by restricting Ceph monitor and OSD communication to trusted storage networks, enforcing Ceph authentication, blocking untrusted access to Ceph ports, preventing untrusted hosts from joining or influencing the cluster, and monitoring for unexpected OSD map changes or client crashes. Where operationally feasible, consider temporarily isolating high-value client nodes from untrusted networks until patched.

How to confirm the fix worked

Confirm exposure by identifying Linux hosts that use the kernel Ceph client, including loaded modules such as ceph, libceph, and rbd, active CephFS mounts, or RBD devices. Validate remediation by checking that the running kernel package or kernel build includes the upstream fix for libceph decode_choose_args() NULL bucket validation. Reboot into the patched kernel if the update installed a new kernel image. Confirm that CephFS mounts and RBD mappings operate normally after patching. Review kernel logs before and after remediation for NULL pointer dereference events involving libceph, crush_decode(), decode_choose_args(), CRUSH map decoding, or CEPH_MSG_OSD_MAP processing. Exposure is most relevant where systems accept Ceph control-plane messages from networks or components that are not tightly trusted.

Typical attack path

1. Identify systems using the Linux kernel Ceph client, such as CephFS mounts or RBD-backed workloads.
2. Gain the ability to influence Ceph OSD map delivery, such as by compromising a Ceph monitor, abusing trusted Ceph network access, or intercepting Ceph control-plane traffic.
3. Craft or introduce a malformed CEPH_MSG_OSD_MAP containing a CRUSH map with choose_args that reference a NULL bucket entry while remaining within max_buckets bounds.
4. Cause a vulnerable client to receive and decode the malicious OSD map.
5. Trigger the NULL pointer dereference in the kernel libceph decode_choose_args() processing path.
6. Cause kernel oops, host instability, client storage failure, or possible system panic/reboot, resulting in denial of service.

How to detect it

Look for evidence of prior exploitation or triggering in kernel logs, system journals, crash dumps, Ceph client logs, and host reboot timelines. Primary sources include dmesg, journalctl -k, /var/log/kern.log, /var/log/messages, /var/log/syslog, kdump/vmcore metadata, crash reporting systems, and Ceph client or monitor logs. Search for kernel NULL pointer dereference events around Ceph activity, especially messages referencing libceph, CRUSH map decoding, OSD map processing, decode_choose_args(), crush_decode(), or CEPH_MSG_OSD_MAP. Correlate any such kernel crashes with recent receipt of new OSD maps, CRUSH map changes, monitor elections, unusual Ceph monitor activity, unauthorized cluster administration, network anomalies on Ceph ports, or simultaneous failures across multiple Ceph clients. Because this vulnerability causes denial of service rather than leaving a reliable file artifact, absence of logs does not fully exclude exploitation, particularly if logs were lost during a crash or reboot.

• BUG: kernel NULL pointer dereference
• Oops: 0000
• kernel NULL pointer dereference
• RIP: decode_choose_args
• decode_choose_args
• crush_decode
• libceph
• CEPH_MSG_OSD_MAP
• CRUSH map
• crush_choose_arg_map
• bucket_index
• ceph: osdmap
• ceph: mon
• /var/log/kern.log
• /var/log/messages
• /var/log/syslog
• journalctl -k
• /proc/modules: libceph
• /proc/modules: ceph
• /proc/modules: rbd

What your security team should do

• Inventory all Linux systems using CephFS, RBD, or the Linux kernel Ceph client and prioritize them for kernel patching.
• Apply vendor kernel updates that include the libceph decode_choose_args() fix; ensure systems boot into the patched kernel.
• Restrict Ceph monitor, OSD, and client communication to trusted storage networks and enforce strong Ceph authentication.
• Investigate any recent kernel oops, panic, reboot, or storage outage events on Ceph client nodes, especially those mentioning libceph, CRUSH map decoding, or NULL pointer dereference.
• Review Ceph monitor and cluster administration activity for unauthorized OSD map, CRUSH map, or monitor changes.
• Add SOC detections for kernel crash logs containing libceph, decode_choose_args, crush_decode, CEPH_MSG_OSD_MAP, or CRUSH map decoding terms.
• Because EPSS is low and the issue is not listed in KEV, prioritize based on storage criticality and exposure rather than broad internet-exploitation urgency.