What’s Vulnerable › Vulnerabilities

CVE-2026-52962: ceph: fix a buffer leak in __ceph_setxattr()

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-24 · updated 2026-07-14
• Weakness: CWE-787

Description

In the Linux kernel, the following vulnerability has been resolved: ceph: fix a buffer leak in __ceph_setxattr() The old_blob in __ceph_setxattr() can store ci->i_xattrs.prealloc_blob value during the retry. However, it is never called the ceph_buffer_put() for the old_blob object. This patch fixes the issue of the buffer leak.

Affected products

• Linux kernel: from 4.4.192 before 4.5; from 4.9.192 before 4.10; from 4.14.143 before 4.15; from 4.19.72 before 4.20; from 5.2.14 before 5.3; from 5.3.1 before 5.10.258 — fixed in 4.10, 4.15, 4.20, 4.5, 5.10.258, 5.15.209

How to fix

Upgrade to a fixed version: Linux kernel 4.10, 4.15, 4.20, 4.5. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/3fa13ceefbc5f36131110342743994cb3de80637
• https://git.kernel.org/stable/c/4bfdcefdaa6092a06cacd59389c7756b36e6de8c
• https://git.kernel.org/stable/c/521e5aba857fd267624892c8dd6295f22ce0267e
• https://git.kernel.org/stable/c/5d3cc36b4e77a27ce7b686b7c59c7072bcb3fa8e
• https://git.kernel.org/stable/c/7d3e8d2d648d5f0df29b4710246680f47695fe94
• https://git.kernel.org/stable/c/bc7abce4460e490dcb579eec770f175b150b685f
• https://git.kernel.org/stable/c/d0cb994605c84a159c1d00d72cdc8583c321ef95
• https://git.kernel.org/stable/c/ecf94823c5c6a20790bb76ed2816822b0beb0c22

Get alerted when CVE-2026-52962 or the next vulnerability affects your stack