CVE-2026-52955

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> libceph: Fix potential out-of-bounds access in crush_decode()<br /> <br /> A message of type CEPH_MSG_OSD_MAP containing a crush map with at least<br /> one bucket has two fields holding the bucket algorithm. If the values<br /> in these two fields differ, an out-of-bounds access can occur. This is<br /> the case because the first algorithm field (alg) is used to allocate<br /> the correct amount of memory for a bucket of this type, while the second<br /> algorithm field inside the bucket (b-&gt;alg) is used in the subsequent<br /> processing.<br /> <br /> This patch fixes the issue by adding a check that compares alg and<br /> b-&gt;alg and aborts the processing in case they differ. Furthermore,<br /> b-&gt;alg is set to 0 in this case, because the destruction of the crush<br /> map also uses this field to determine the bucket type, which can again<br /> result in an out-of-bounds access when trying to free the memory pointed<br /> to by the fields of the bucket. To correctly free the memory allocated<br /> for the bucket in such a case, the corresponding call to kfree is moved<br /> from the algorithm-specific crush_destroy_bucket functions to the<br /> generic crush_destroy_bucket().