---
id: CVE-2026-52954
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  libceph: handle rbtree insertion error in decode_choose_args()

  A message of type CEPH_MSG_OSD_MAP contains an OSD map that itself
  contains a CRUSH map
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  libceph: handle rbtree insertion error in decode_choose_args()

  A message of type CEPH_MSG_OSD_MAP contains an OSD map that itself
  contains a CRUSH map. The received CR…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
published: '2026-06-24'
updated: '2026-06-29'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-52954'
references:
  - url: 'https://git.kernel.org/stable/c/0a1265a9ab875f92b6a3ffb497404f46cf9d76a3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/0b6a3bcb91bc5bfeda39f0df3b71bab62c13e9da'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4d2b37abda9536808655830d683dc491d31741a8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/534ebc08df97c47d4c7596f336fa31ecbf91519c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/80c73bd1b2b04355d1d0c29be8ccbd25a380905d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c7bf7864e2924fa5508ac270b0e9364bc13d5a6c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d289478cfc0bcf81c7914200d6abdcb78bd04ded'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f47430fc1f815e87406e2d3b4e476eff1bc7fd9b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00716
epssPercentile: 0.51778
ingestedAt: '2026-06-29T13:42:11.988Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

libceph: handle rbtree insertion error in decode_choose_args()

A message of type CEPH_MSG_OSD_MAP contains an OSD map that itself
contains a CRUSH map. The received CRUSH map may optionally contain
choose_args that get decoded in decode_choose_args(). In this function,
num_choose_arg_maps is read from the message, and a corresponding number
of crush_choose_arg_maps gets decoded afterwards. Each
crush_choose_arg_map has a choose_args_index, which serves as the key
when inserting it into the choose_args rbtree of the decoded crush_map.
If a (potentially corrupted) message contains two crush_choose_arg_maps
with the same index, the assertion in insert_choose_arg_map() triggers a
kernel BUG when trying to insert the second crush_choose_arg_map.

This patch fixes the issue by switching to the non-asserting rbtree
insertion function and rejecting the message if the insertion fails.

[ idryomov: changelog ]

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.