CVE-2026-52956

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()<br /> <br /> In __ceph_x_decrypt(), a part of the buffer p is interpreted as a<br /> ceph_x_encrypt_header, and the magic field of this struct is accessed.<br /> This happens without any guarantee that the buffer is large enough to<br /> hold this struct. The function parameter ciphertext_len represents the<br /> length of the ciphertext to decrypt and is guaranteed to be at most the<br /> remaining size of the allocated buffer p. However, this value is not<br /> necessarily greater than sizeof(ceph_x_encrypt_header). E.g., a message<br /> frame of type FRAME_TAG_AUTH_REPLY_MORE, that is just as long to hold<br /> the ciphertext at its end with a ciphertext_len of 8 or less, can<br /> trigger an out-of-bounds memory access when accessing hdr-&gt;magic.<br /> <br /> This patch fixes the issue by adding a check to ensure that the<br /> decrypted plaintext in the buffer is large enough to represent at least<br /> the ceph_x_encrypt_header.