CVE-2026-43405

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> libceph: Use u32 for non-negative values in ceph_monmap_decode()<br /> <br /> This patch fixes unnecessary implicit conversions that change signedness<br /> of blob_len and num_mon in ceph_monmap_decode().<br /> Currently blob_len and num_mon are (signed) int variables. They are used<br /> to hold values that are always non-negative and get assigned in<br /> ceph_decode_32_safe(), which is meant to assign u32 values. Both<br /> variables are subsequently used as unsigned values, and the value of<br /> num_mon is further assigned to monmap-&gt;num_mon, which is of type u32.<br /> Therefore, both variables should be of type u32. This is especially<br /> relevant for num_mon. If the value read from the incoming message is<br /> very large, it is interpreted as a negative value, and the check for<br /> num_mon &gt; CEPH_MAX_MON does not catch it. This leads to the attempt to<br /> allocate a very large chunk of memory for monmap, which will most likely<br /> fail. In this case, an unnecessary attempt to allocate memory is<br /> performed, and -ENOMEM is returned instead of -EINVAL.