CVE-2026-52957

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> libceph: Fix potential null-ptr-deref in decode_choose_args()<br /> <br /> A message of type CEPH_MSG_OSD_MAP contains an OSD map that itself<br /> contains a CRUSH map. When decoding this CRUSH map in crush_decode(), an<br /> array of max_buckets CRUSH buckets is decoded, where some indices may<br /> not refer to actual buckets and are therefore set to NULL. The received<br /> CRUSH map may optionally contain choose_args that get decoded in<br /> decode_choose_args(). When decoding a crush_choose_arg_map, a series of<br /> choose_args for different buckets is decoded, with the bucket_index<br /> being read from the incoming message. It is only checked that the bucket<br /> index does not exceed max_buckets, but not that it doesn&amp;#39;t point to an<br /> index with a NULL bucket. If a (potentially corrupted) message contains<br /> a crush_choose_arg_map including such a bucket_index, a null pointer<br /> dereference may occur in the subsequent processing when attempting to<br /> access the bucket with the given index.<br /> <br /> This patch fixes the issue by extending the affected check. Now, it is<br /> only attempted to access the bucket if it is not NULL.