Answer in brief
CVE-2026-52954 records a High severity (CVSS 7.5) vulnerability in libceph: handle rbtree insertion error in decode_choose_args(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-52954 records a High severity (CVSS 7.5) vulnerability in libceph: handle rbtree insertion error in decode_choose_args(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=5cf9c4a9959b6273675310d14a834ef14fbca37c <c7bf7864e2924fa5508ac270b0e9364bc13d5a6c || >=5cf9c4a9959b6273675310d14a834ef14fbca37c <f47430fc1f815e87406e2d3b4e476eff1bc7fd9b || >=5cf9c4a9959b6273675310d14a834ef14fbca37c <0b6a3bcb91bc5bfeda39f0df3b71bab62c13e9da || >=5cf9c4a9959b6273675310d14a834ef14fbca37c <534ebc08df97c47d4c7596f336fa31ecbf91519c || >=5cf9c4a9959b6273675310d14a834ef14fbca37c <80c73bd1b2b04355d1d0c29be8ccbd25a380905d || >=5cf9c4a9959b6273675310d14a834ef14fbca37c <4d2b37abda9536808655830d683dc491d31741a8 || >=5cf9c4a9959b6273675310d14a834ef14fbca37c <0a1265a9ab875f92b6a3ffb497404f46cf9d76a3 || >=5cf9c4a9959b6273675310d14a834ef14fbca37c <d289478cfc0bcf81c7914200d6abdcb78bd04ded | c7bf7864e2924fa5508ac270b0e9364bc13d5a6c, f47430fc1f815e87406e2d3b4e476eff1bc7fd9b, 0b6a3bcb91bc5bfeda39f0df3b71bab62c13e9da, 534ebc08df97c47d4c7596f336fa31ecbf91519c, 80c73bd1b2b04355d1d0c29be8ccbd25a380905d, 4d2b37abda9536808655830d683dc491d31741a8, 0a1265a9ab875f92b6a3ffb497404f46cf9d76a3, d289478cfc0bcf81c7914200d6abdcb78bd04ded |
| Linux/Linuxgeneric | 4.13 | Not reported |
Published upstream
Jun 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 24, 2026
In the Linux kernel, the following vulnerability has been resolved: libceph: handle rbtree insertion error in decode_choose_args() A message of type CEPH_MSG_OSD_MAP contains an OSD map that itself contains a CRUSH map. The received CRUSH map may optionally contain choose_args that get decoded in decode_choose_args(). In this function, num_choose_arg_maps is read from the message, and a corresponding number of crush_choose_arg_maps gets decoded afterwards. Each crush_choose_arg_map has a choose_args_index, which serves as the key when inserting it into the choose_args rbtree of the decoded crush_map. If a (potentially corrupted) message contains two crush_choose_arg_maps with the same index, the assertion in insert_choose_arg_map() triggers a kernel BUG when trying to insert the second crush_choose_arg_map. This patch fixes the issue by switching to the non-asserting rbtree insertion function and rejecting the message if the insertion fails. [ idryomov: changelog ]
Quoted source text, attributed separately from HOL analysis.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=5cf9c4a9959b6273675310d14a834ef14fbca37c <c7bf7864e2924fa5508ac270b0e9364bc13d5a6c || >=5cf9c4a9959b6273675310d14a834ef14fbca37c <f47430fc1f815e87406e2d3b4e476eff1bc7fd9b || >=5cf9c4a9959b6273675310d14a834ef14fbca37c <0b6a3bcb91bc5bfeda39f0df3b71bab62c13e9da || >=5cf9c4a9959b6273675310d14a834ef14fbca37c <534ebc08df97c47d4c7596f336fa31ecbf91519c || >=5cf9c4a9959b6273675310d14a834ef14fbca37c <80c73bd1b2b04355d1d0c29be8ccbd25a380905d || >=5cf9c4a9959b6273675310d14a834ef14fbca37c <4d2b37abda9536808655830d683dc491d31741a8 || >=5cf9c4a9959b6273675310d14a834ef14fbca37c <0a1265a9ab875f92b6a3ffb497404f46cf9d76a3 || >=5cf9c4a9959b6273675310d14a834ef14fbca37c <d289478cfc0bcf81c7914200d6abdcb78bd04ded | c7bf7864e2924fa5508ac270b0e9364bc13d5a6c, f47430fc1f815e87406e2d3b4e476eff1bc7fd9b, 0b6a3bcb91bc5bfeda39f0df3b71bab62c13e9da, 534ebc08df97c47d4c7596f336fa31ecbf91519c, 80c73bd1b2b04355d1d0c29be8ccbd25a380905d, 4d2b37abda9536808655830d683dc491d31741a8, 0a1265a9ab875f92b6a3ffb497404f46cf9d76a3, d289478cfc0bcf81c7914200d6abdcb78bd04ded |
| Linux/Linuxgeneric | 4.13 | Not reported |
Published upstream
Jun 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 24, 2026
In the Linux kernel, the following vulnerability has been resolved: libceph: handle rbtree insertion error in decode_choose_args() A message of type CEPH_MSG_OSD_MAP contains an OSD map that itself contains a CRUSH map. The received CRUSH map may optionally contain choose_args that get decoded in decode_choose_args(). In this function, num_choose_arg_maps is read from the message, and a corresponding number of crush_choose_arg_maps gets decoded afterwards. Each crush_choose_arg_map has a choose_args_index, which serves as the key when inserting it into the choose_args rbtree of the decoded crush_map. If a (potentially corrupted) message contains two crush_choose_arg_maps with the same index, the assertion in insert_choose_arg_map() triggers a kernel BUG when trying to insert the second crush_choose_arg_map. This patch fixes the issue by switching to the non-asserting rbtree insertion function and rejecting the message if the insertion fails. [ idryomov: changelog ]
Quoted source text, attributed separately from HOL analysis.