CVE-2026-52960

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-52960", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.373Z", "datePublished": "2026-06-24T16:28:41.044Z", "dateUpdated": "2026-10-21T12:41:41.907Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:41:41.907Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: put folios not suitable for writeback\n\nThe batch holds references to the folios (see `filemap_get_folios`,\n`folio_batch_release`), so we need to `folio_put` the folios we remove.\n\nTested on v6.18."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - Direct reachability is through CephFS file writeback, and a writable CephFS tree can reasonably be exposed through kernel network fileservers such as nfsd/ksmbd, which drive the same VFS writeback path remotely.\nAC:L - The bug is a deterministic missing folio_put() on skipped writeback folios; an attacker can repeatedly create/write/delete/sync files to accumulate leaked references without needing an uncontrollable race.\nPR:N - In the network-export scenario, the attacker needs no local privileges on the vulnerable host, and writable anonymous or guest-style exports are a reasonable high-severity deployment.\nUI:N - Once the CephFS mount/export exists, exploitation only requires attacker-driven writes and writeback triggers; no victim user action is needed.\nS:U - The impact remains within the vulnerable kernel host and does not cross a separate security authority such as a guest-to-host or IOMMU boundary.\nC:N - The flaw leaks folio references and pins page-cache memory; it does not provide an information disclosure or arbitrary read primitive.\nI:N - The flaw does not corrupt memory or allow unauthorized data modification; it only prevents selected folios from being released.\nA:H - Repeated triggering can leave folios permanently unreclaimable even after unmount/drop_caches, causing severe memory pressure, swapping, allocation failures, and potential system-wide DoS."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ceph/addr.c"], "versions": [{"version": "ce80b76dd32764cc914975777e058d4fae4f0ea0", "lessThan": "349499a65b6b5fb6f66ba3673598ab558f48c544", "status": "affected", "versionType": "git"}, {"version": "ce80b76dd32764cc914975777e058d4fae4f0ea0", "lessThan": "86921e890fe1dea9791fb70bec552516fd47716a", "status": "affected", "versionType": "git"}, {"version": "ce80b76dd32764cc914975777e058d4fae4f0ea0", "lessThan": "544576f0f05c4a759806acddfaaeb686f14fb4b0", "status": "affected", "versionType": "git"}, {"version": "0f2b2b7cacf888229cec19126e6791b11fb35f32", "status": "affected", "versionType": "git"}, {"version": "6.12.114", "lessThan": "6.13", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ceph/addr.c"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.10", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.0.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.114"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/349499a65b6b5fb6f66ba3673598ab558f48c544"}, {"url": "https://git.kernel.org/stable/c/86921e890fe1dea9791fb70bec552516fd47716a"}, {"url": "https://git.kernel.org/stable/c/544576f0f05c4a759806acddfaaeb686f14fb4b0"}], "title": "ceph: put folios not suitable for writeback", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-52960", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:23:36.378795Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-401", "description": "CWE-401 Missing Release of Memory after Effective Lifetime"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:47:10.567Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-52960", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:23:36.378795Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-401", "description": "CWE-401 Missing Release of Memory after Effective Lifetime"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:23:36.903Z"}}], "cna": {"title": "ceph: put folios not suitable for writeback", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - Direct reachability is through CephFS file writeback, and a writable CephFS tree can reasonably be exposed through kernel network fileservers such as nfsd/ksmbd, which drive the same VFS writeback path remotely.\nAC:L - The bug is a deterministic missing folio_put() on skipped writeback folios; an attacker can repeatedly create/write/delete/sync files to accumulate leaked references without needing an uncontrollable race.\nPR:N - In the network-export scenario, the attacker needs no local privileges on the vulnerable host, and writable anonymous or guest-style exports are a reasonable high-severity deployment.\nUI:N - Once the CephFS mount/export exists, exploitation only requires attacker-driven writes and writeback triggers; no victim user action is needed.\nS:U - The impact remains within the vulnerable kernel host and does not cross a separate security authority such as a guest-to-host or IOMMU boundary.\nC:N - The flaw leaks folio references and pins page-cache memory; it does not provide an information disclosure or arbitrary read primitive.\nI:N - The flaw does not corrupt memory or allow unauthorized data modification; it only prevents selected folios from being released.\nA:H - Repeated triggering can leave folios permanently unreclaimable even after unmount/drop_caches, causing severe memory pressure, swapping, allocation failures, and potential system-wide DoS."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ce80b76dd32764cc914975777e058d4fae4f0ea0", "lessThan": "349499a65b6b5fb6f66ba3673598ab558f48c544", "versionType": "git"}, {"status": "affected", "version": "ce80b76dd32764cc914975777e058d4fae4f0ea0", "lessThan": "86921e890fe1dea9791fb70bec552516fd47716a", "versionType": "git"}, {"status": "affected", "version": "ce80b76dd32764cc914975777e058d4fae4f0ea0", "lessThan": "544576f0f05c4a759806acddfaaeb686f14fb4b0", "versionType": "git"}, {"status": "affected", "version": "0f2b2b7cacf888229cec19126e6791b11fb35f32", "versionType": "git"}, {"status": "affected", "version": "6.12.114", "lessThan": "6.13", "versionType": "semver"}], "programFiles": ["fs/ceph/addr.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"status": "unaffected", "version": "0", "lessThan": "6.15", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.57", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.10", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/ceph/addr.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/349499a65b6b5fb6f66ba3673598ab558f48c544"}, {"url": "https://git.kernel.org/stable/c/86921e890fe1dea9791fb70bec552516fd47716a"}, {"url": "https://git.kernel.org/stable/c/544576f0f05c4a759806acddfaaeb686f14fb4b0"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: put folios not suitable for writeback\n\nThe batch holds references to the folios (see `filemap_get_folios`,\n`folio_batch_release`), so we need to `folio_put` the folios we remove.\n\nTested on v6.18."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.57", "versionStartIncluding": "6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.10", "versionStartIncluding": "6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.12.114"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:41:41.907Z"}}}, "cveMetadata": {"cveId": "CVE-2026-52960", "state": "PUBLISHED", "dateUpdated": "2026-10-21T12:41:41.907Z", "dateReserved": "2026-06-09T07:44:35.373Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-06-24T16:28:41.044Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/ceph/addr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "349499a65b6b5fb6f66ba3673598ab558f48c544", "status": "affected", "version": "ce80b76dd32764cc914975777e058d4fae4f0ea0", "versionType": "git"}, {"lessThan": "86921e890fe1dea9791fb70bec552516fd47716a", "status": "affected", "version": "ce80b76dd32764cc914975777e058d4fae4f0ea0", "versionType": "git"}, {"lessThan": "544576f0f05c4a759806acddfaaeb686f14fb4b0", "status": "affected", "version": "ce80b76dd32764cc914975777e058d4fae4f0ea0", "versionType": "git"}, {"status": "affected", "version": "0f2b2b7cacf888229cec19126e6791b11fb35f32", "versionType": "git"}, {"lessThan": "6.13", "status": "affected", "version": "6.12.114", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/ceph/addr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"lessThan": "6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2E6E44BD-EA5E-41E8-907D-E2A9C379B66B", "versionEndExcluding": "7.0.10", "versionStartIncluding": "6.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: put folios not suitable for writeback\n\nThe batch holds references to the folios (see `filemap_get_folios`,\n`folio_batch_release`), so we need to `folio_put` the folios we remove.\n\nTested on v6.18."}], "id": "CVE-2026-52960", "lastModified": "2026-10-21T13:19:07.377", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-52960", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:23:36.378795Z", "version": "2.0.3"}}]}, "published": "2026-06-24T17:17:06.260", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/349499a65b6b5fb6f66ba3673598ab558f48c544"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/544576f0f05c4a759806acddfaaeb686f14fb4b0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/86921e890fe1dea9791fb70bec552516fd47716a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-401"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: ceph: put folios not suitable for writeback", "id": "2492262", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492262"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["A flaw was found in the Linux kernel's Ceph component. This vulnerability occurs due to improper handling of memory pages, known as folios, that are not suitable for writeback. When certain folios are removed, their references are not properly released, leading to a resource leak. A local attacker could potentially exploit this to cause resource exhaustion, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-52960", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-52960\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-52960\nhttps://lore.kernel.org/linux-cve-announce/2026062436-CVE-2026-52960-9da2@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,86921e890fe1dea9791fb70bec552516fd47716a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,544576f0f05c4a759806acddfaaeb686f14fb4b0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.0.10)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.10,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1,8.0.0)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-24T20:30:04.518759+00:00", "updated": "2026-10-20T14:45:13.861090+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}