CVE-2026-52956

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-52956", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.373Z", "datePublished": "2026-06-24T16:28:38.414Z", "dateUpdated": "2026-10-30T12:26:21.612Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:26:21.612Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Fix potential out-of-bounds access in __ceph_x_decrypt()\n\nIn __ceph_x_decrypt(), a part of the buffer p is interpreted as a\nceph_x_encrypt_header, and the magic field of this struct is accessed.\nThis happens without any guarantee that the buffer is large enough to\nhold this struct. The function parameter ciphertext_len represents the\nlength of the ciphertext to decrypt and is guaranteed to be at most the\nremaining size of the allocated buffer p. However, this value is not\nnecessarily greater than sizeof(ceph_x_encrypt_header). E.g., a message\nframe of type FRAME_TAG_AUTH_REPLY_MORE, that is just as long to hold\nthe ciphertext at its end with a ciphertext_len of 8 or less, can\ntrigger an out-of-bounds memory access when accessing hdr->magic.\n\nThis patch fixes the issue by adding a check to ensure that the\ndecrypted plaintext in the buffer is large enough to represent at least\nthe ceph_x_encrypt_header."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable CephX decrypt path processes auth payloads received over the Ceph messenger TCP protocol from monitors/OSDs/MDSs. A malicious or compromised remote Ceph peer can supply the malformed auth frame during connection authentication.\nAC:L - The attacker controls the frame and ciphertext length needed to reach the missing plaintext-size check. No race or unusual victim state is required once the kernel client connects to the attacker-controlled peer.\nPR:N - The vulnerable parsing occurs in the authentication handshake before the remote peer has been authenticated by the kernel client. The attacker needs no privileges on the vulnerable system.\nUI:N - In a reasonable deployment, a configured kernel Ceph client connects or reconnects to its Ceph peers automatically. Exploitation does not require an interactive victim action at trigger time.\nS:U - The impact is within the kernel/client system processing the Ceph protocol. It does not cross a separate security authority such as a guest-to-host or IOMMU boundary.\nC:N - The bug is a bounded out-of-bounds read of the CephX encryption header magic field, but the read value is only compared internally and is not returned to the attacker. There is no practical information disclosure primitive.\nI:N - The vulnerable code performs no write based on the out-of-bounds access. The fix adds a read-side length check and there is no memory corruption or data modification path.\nA:H - The peer-controlled short plaintext can trigger an out-of-bounds kernel memory access in the auth receive path. Such kernel OOB accesses can produce an oops/panic or otherwise terminate the Ceph client connection, so availability impact is high."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ceph/auth_x.c"], "versions": [{"version": "e15fd0a11db00fc7f470a9fc804657ec3f6d04a5", "lessThan": "c417b7d2d1c7fdc25af24490201320e36a3cc21d", "status": "affected", "versionType": "git"}, {"version": "e15fd0a11db00fc7f470a9fc804657ec3f6d04a5", "lessThan": "759053333a40c6997c2917dcd6160bfe40d2b42e", "status": "affected", "versionType": "git"}, {"version": "e15fd0a11db00fc7f470a9fc804657ec3f6d04a5", "lessThan": "ebc7eddf6225b87e3aae720875f9dd40cb6b1cef", "status": "affected", "versionType": "git"}, {"version": "e15fd0a11db00fc7f470a9fc804657ec3f6d04a5", "lessThan": "5df268406ef38d0f92547959296577c7077dacdc", "status": "affected", "versionType": "git"}, {"version": "e15fd0a11db00fc7f470a9fc804657ec3f6d04a5", "lessThan": "c7e9b53aebe401970f1b5f5a01b4e021b18e8bb2", "status": "affected", "versionType": "git"}, {"version": "e15fd0a11db00fc7f470a9fc804657ec3f6d04a5", "lessThan": "821365487aa58d06bda65c676ba215d506ba9768", "status": "affected", "versionType": "git"}, {"version": "2982b9c92a66604ffb9fb2db54cf735133d1ef56", "status": "affected", "versionType": "git"}, {"version": "4.9.6", "lessThan": "4.10", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ceph/auth_x.c"], "versions": [{"version": "4.10", "status": "affected"}, {"version": "0", "lessThan": "4.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.10", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "7.0.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "7.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9.6"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c417b7d2d1c7fdc25af24490201320e36a3cc21d"}, {"url": "https://git.kernel.org/stable/c/759053333a40c6997c2917dcd6160bfe40d2b42e"}, {"url": "https://git.kernel.org/stable/c/ebc7eddf6225b87e3aae720875f9dd40cb6b1cef"}, {"url": "https://git.kernel.org/stable/c/5df268406ef38d0f92547959296577c7077dacdc"}, {"url": "https://git.kernel.org/stable/c/c7e9b53aebe401970f1b5f5a01b4e021b18e8bb2"}, {"url": "https://git.kernel.org/stable/c/821365487aa58d06bda65c676ba215d506ba9768"}], "title": "libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-52956", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:23:29.086880Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:47:10.097Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-52956", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:23:29.086880Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:23:29.971Z"}}], "cna": {"title": "libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable CephX decrypt path processes auth payloads received over the Ceph messenger TCP protocol from monitors/OSDs/MDSs. A malicious or compromised remote Ceph peer can supply the malformed auth frame during connection authentication.\nAC:L - The attacker controls the frame and ciphertext length needed to reach the missing plaintext-size check. No race or unusual victim state is required once the kernel client connects to the attacker-controlled peer.\nPR:N - The vulnerable parsing occurs in the authentication handshake before the remote peer has been authenticated by the kernel client. The attacker needs no privileges on the vulnerable system.\nUI:N - In a reasonable deployment, a configured kernel Ceph client connects or reconnects to its Ceph peers automatically. Exploitation does not require an interactive victim action at trigger time.\nS:U - The impact is within the kernel/client system processing the Ceph protocol. It does not cross a separate security authority such as a guest-to-host or IOMMU boundary.\nC:N - The bug is a bounded out-of-bounds read of the CephX encryption header magic field, but the read value is only compared internally and is not returned to the attacker. There is no practical information disclosure primitive.\nI:N - The vulnerable code performs no write based on the out-of-bounds access. The fix adds a read-side length check and there is no memory corruption or data modification path.\nA:H - The peer-controlled short plaintext can trigger an out-of-bounds kernel memory access in the auth receive path. Such kernel OOB accesses can produce an oops/panic or otherwise terminate the Ceph client connection, so availability impact is high."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "e15fd0a11db00fc7f470a9fc804657ec3f6d04a5", "lessThan": "c417b7d2d1c7fdc25af24490201320e36a3cc21d", "versionType": "git"}, {"status": "affected", "version": "e15fd0a11db00fc7f470a9fc804657ec3f6d04a5", "lessThan": "759053333a40c6997c2917dcd6160bfe40d2b42e", "versionType": "git"}, {"status": "affected", "version": "e15fd0a11db00fc7f470a9fc804657ec3f6d04a5", "lessThan": "ebc7eddf6225b87e3aae720875f9dd40cb6b1cef", "versionType": "git"}, {"status": "affected", "version": "e15fd0a11db00fc7f470a9fc804657ec3f6d04a5", "lessThan": "5df268406ef38d0f92547959296577c7077dacdc", "versionType": "git"}, {"status": "affected", "version": "e15fd0a11db00fc7f470a9fc804657ec3f6d04a5", "lessThan": "c7e9b53aebe401970f1b5f5a01b4e021b18e8bb2", "versionType": "git"}, {"status": "affected", "version": "e15fd0a11db00fc7f470a9fc804657ec3f6d04a5", "lessThan": "821365487aa58d06bda65c676ba215d506ba9768", "versionType": "git"}, {"status": "affected", "version": "2982b9c92a66604ffb9fb2db54cf735133d1ef56", "versionType": "git"}, {"status": "affected", "version": "4.9.6", "lessThan": "4.10", "versionType": "semver"}], "programFiles": ["net/ceph/auth_x.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.10"}, {"status": "unaffected", "version": "0", "lessThan": "4.10", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.114", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.57", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.10", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/ceph/auth_x.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/c417b7d2d1c7fdc25af24490201320e36a3cc21d"}, {"url": "https://git.kernel.org/stable/c/759053333a40c6997c2917dcd6160bfe40d2b42e"}, {"url": "https://git.kernel.org/stable/c/ebc7eddf6225b87e3aae720875f9dd40cb6b1cef"}, {"url": "https://git.kernel.org/stable/c/5df268406ef38d0f92547959296577c7077dacdc"}, {"url": "https://git.kernel.org/stable/c/c7e9b53aebe401970f1b5f5a01b4e021b18e8bb2"}, {"url": "https://git.kernel.org/stable/c/821365487aa58d06bda65c676ba215d506ba9768"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Fix potential out-of-bounds access in __ceph_x_decrypt()\n\nIn __ceph_x_decrypt(), a part of the buffer p is interpreted as a\nceph_x_encrypt_header, and the magic field of this struct is accessed.\nThis happens without any guarantee that the buffer is large enough to\nhold this struct. The function parameter ciphertext_len represents the\nlength of the ciphertext to decrypt and is guaranteed to be at most the\nremaining size of the allocated buffer p. However, this value is not\nnecessarily greater than sizeof(ceph_x_encrypt_header). E.g., a message\nframe of type FRAME_TAG_AUTH_REPLY_MORE, that is just as long to hold\nthe ciphertext at its end with a ciphertext_len of 8 or less, can\ntrigger an out-of-bounds memory access when accessing hdr->magic.\n\nThis patch fixes the issue by adding a check to ensure that the\ndecrypted plaintext in the buffer is large enough to represent at least\nthe ceph_x_encrypt_header."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.191", "versionStartIncluding": "4.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.160", "versionStartIncluding": "4.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.114", "versionStartIncluding": "4.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.57", "versionStartIncluding": "4.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.10", "versionStartIncluding": "4.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "4.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.9.6"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:26:21.612Z"}}}, "cveMetadata": {"cveId": "CVE-2026-52956", "state": "PUBLISHED", "dateUpdated": "2026-10-30T12:26:21.612Z", "dateReserved": "2026-06-09T07:44:35.373Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-06-24T16:28:38.414Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ceph/auth_x.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c417b7d2d1c7fdc25af24490201320e36a3cc21d", "status": "affected", "version": "e15fd0a11db00fc7f470a9fc804657ec3f6d04a5", "versionType": "git"}, {"lessThan": "759053333a40c6997c2917dcd6160bfe40d2b42e", "status": "affected", "version": "e15fd0a11db00fc7f470a9fc804657ec3f6d04a5", "versionType": "git"}, {"lessThan": "ebc7eddf6225b87e3aae720875f9dd40cb6b1cef", "status": "affected", "version": "e15fd0a11db00fc7f470a9fc804657ec3f6d04a5", "versionType": "git"}, {"lessThan": "5df268406ef38d0f92547959296577c7077dacdc", "status": "affected", "version": "e15fd0a11db00fc7f470a9fc804657ec3f6d04a5", "versionType": "git"}, {"lessThan": "c7e9b53aebe401970f1b5f5a01b4e021b18e8bb2", "status": "affected", "version": "e15fd0a11db00fc7f470a9fc804657ec3f6d04a5", "versionType": "git"}, {"lessThan": "821365487aa58d06bda65c676ba215d506ba9768", "status": "affected", "version": "e15fd0a11db00fc7f470a9fc804657ec3f6d04a5", "versionType": "git"}, {"status": "affected", "version": "2982b9c92a66604ffb9fb2db54cf735133d1ef56", "versionType": "git"}, {"lessThan": "4.10", "status": "affected", "version": "4.9.6", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ceph/auth_x.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.10"}, {"lessThan": "4.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "30F5EFF7-D7B1-4978-9EE9-4B7D43BB17BE", "versionEndExcluding": "4.10", "versionStartIncluding": "4.9.6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "55A81ECB-F98C-4BCB-8C23-5307F379BFDB", "versionEndExcluding": "7.0.10", "versionStartIncluding": "4.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Fix potential out-of-bounds access in __ceph_x_decrypt()\n\nIn __ceph_x_decrypt(), a part of the buffer p is interpreted as a\nceph_x_encrypt_header, and the magic field of this struct is accessed.\nThis happens without any guarantee that the buffer is large enough to\nhold this struct. The function parameter ciphertext_len represents the\nlength of the ciphertext to decrypt and is guaranteed to be at most the\nremaining size of the allocated buffer p. However, this value is not\nnecessarily greater than sizeof(ceph_x_encrypt_header). E.g., a message\nframe of type FRAME_TAG_AUTH_REPLY_MORE, that is just as long to hold\nthe ciphertext at its end with a ciphertext_len of 8 or less, can\ntrigger an out-of-bounds memory access when accessing hdr->magic.\n\nThis patch fixes the issue by adding a check to ensure that the\ndecrypted plaintext in the buffer is large enough to represent at least\nthe ceph_x_encrypt_header."}], "id": "CVE-2026-52956", "lastModified": "2026-10-30T13:19:04.767", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-52956", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:23:29.086880Z", "version": "2.0.3"}}]}, "published": "2026-06-24T17:17:05.807", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5df268406ef38d0f92547959296577c7077dacdc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/759053333a40c6997c2917dcd6160bfe40d2b42e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/821365487aa58d06bda65c676ba215d506ba9768"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c417b7d2d1c7fdc25af24490201320e36a3cc21d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c7e9b53aebe401970f1b5f5a01b4e021b18e8bb2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ebc7eddf6225b87e3aae720875f9dd40cb6b1cef"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-125"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()", "id": "2492355", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492355"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in the Linux kernel's `libceph` module. A remote attacker could trigger an out-of-bounds memory access in the `__ceph_x_decrypt()` function by sending a specially crafted message frame of type `FRAME_TAG_AUTH_REPLY_MORE` with a small ciphertext length. This vulnerability arises because the function interprets a buffer as a `ceph_x_encrypt_header` without ensuring the buffer is large enough. Successful exploitation could lead to a denial of service or other unpredictable system behavior."], "name": "CVE-2026-52956", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-52956\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-52956\nhttps://lore.kernel.org/linux-cve-announce/2026062435-CVE-2026-52956-99b7@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c7e9b53aebe401970f1b5f5a01b4e021b18e8bb2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,821365487aa58d06bda65c676ba215d506ba9768)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,7.0.10)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.10,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-24T21:00:11.197707+00:00", "updated": "2026-06-28T13:45:06.289140+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}