CVE-2026-52962
ceph: fix a buffer leak in __ceph_setxattr()
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.5, 4.10, 4.15, 4.20, 5.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: ceph: fix a buffer leak in __ceph_setxattr() The old_blob in __ceph_setxattr() can store ci->i_xattrs.prealloc_blob value during the retry. However, it is never called the ceph_buffer_put() for the old_blob object. This patch fixes the issue of the buffer leak.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 4.4.192 · fixed in 4.5; From 4.9.192 · fixed in 4.10; From 4.14.143 · fixed in 4.15; From 4.19.72 · fixed in 4.20; From 5.2.14 · fixed in 5.3
- Linux Linux
5.3
References 8
git.kernel.org
- stable/c/521e5aba857fd267624892c8dd6295f22ce0267e
- stable/c/d0cb994605c84a159c1d00d72cdc8583c321ef95
- stable/c/ecf94823c5c6a20790bb76ed2816822b0beb0c22
- stable/c/4bfdcefdaa6092a06cacd59389c7756b36e6de8c
- stable/c/7d3e8d2d648d5f0df29b4710246680f47695fe94
- stable/c/3fa13ceefbc5f36131110342743994cb3de80637
- stable/c/bc7abce4460e490dcb579eec770f175b150b685f
- stable/c/5d3cc36b4e77a27ce7b686b7c59c7072bcb3fa8e