CVE-2026-52962

ceph: fix a buffer leak in __ceph_setxattr()

HIGH

7.8

CVSS Score

Published: June 24, 2026 at 04:28 PM UTC

Updated: July 14, 2026 at 04:37 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: ceph: fix a buffer leak in __ceph_setxattr() The old_blob in __ceph_setxattr() can store ci->i_xattrs.prealloc_blob value during the retry. However, it is never called the ceph_buffer_put() for the old_blob object. This patch fixes the issue of the buffer leak.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

v ≥ 4.14.143v ≥ 4.19.72v ≥ 4.4.192v ≥ 4.9.192v ≥ 5.2.144.14.143 ≤ v < 4.154.19.72 ≤ v < 4.204.4.192 ≤ v < 4.54.9.192 ≤ v < 4.105.11 ≤ v < 5.15.2095.16 ≤ v < 6.1.1755.2.14 ≤ v < 5.35.3 ≤ v < 5.10.2585.3 ≤ v < 5.15.2095.3 ≤ v < 6.1.1755.3 ≤ v < 6.12.915.3 ≤ v < 6.18.335.3 ≤ v < 6.6.1415.3 ≤ v < 7.0.105.3 ≤ v < 7.15.3.1 ≤ v < 5.10.2586.13 ≤ v < 6.18.336.19 ≤ v < 7.0.106.2 ≤ v < 6.6.1416.7 ≤ v < 6.12.911d86cb8d3204337e1853b84d69ea0f30dc0ba9734.14.143 4.19.72 4.4.192 4.9.192 5.2.14 5.3 5.3 rc6 5.3 rc7 5.3 rc8 7.1 rc1 7.1 rc2 7.1 rc386968ef21596515958d5f0a40233d02be78ecec09cec64d3f6d91da590cc4069172254067b43d0b2de30fc2ca852365ed635f62d7d818bffc15e55c9dfb8712c7acce0689aed6c400a22b35f4d2861fef41cd559f1f3412db8e0acdede05ecf990ebfd8a

Vendor states this is fixed in 3fa13ceefbc5f36131110342743994cb3de80637 (fixed)

Vendor states this is fixed in 4bfdcefdaa6092a06cacd59389c7756b36e6de8c (fixed)

Vendor states this is fixed in 521e5aba857fd267624892c8dd6295f22ce0267e (fixed)

Vendor states this is fixed in 5d3cc36b4e77a27ce7b686b7c59c7072bcb3fa8e (fixed)

Vendor states this is fixed in 7d3e8d2d648d5f0df29b4710246680f47695fe94 (fixed)

Vendor states this is fixed in bc7abce4460e490dcb579eec770f175b150b685f (fixed)

Vendor states this is fixed in d0cb994605c84a159c1d00d72cdc8583c321ef95 (fixed)

Vendor states this is fixed in ecf94823c5c6a20790bb76ed2816822b0beb0c22 (fixed)

Affected range stops below 4.10, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.15, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.20, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.5, so it looks safe — our inference, not a vendor statement