Description
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in crush_decode() A message of type CEPH_MSG_OSD_MAP containing a crush map with at least one bucket has two fields holding the bucket algorithm. If the values in these two fields differ, an out-of-bounds access can occur. This is the case because the first algorithm field (alg) is used to allocate the correct amount of memory for a bucket of this type, while the second algorithm field inside the bucket (b->alg) is used in the subsequent processing. This patch fixes the issue by adding a check that compares alg and b->alg and aborts the processing in case they differ. Furthermore, b->alg is set to 0 in this case, because the destruction of the crush map also uses this field to determine the bucket type, which can again result in an out-of-bounds access when trying to free the memory pointed to by the fields of the bucket. To correctly free the memory allocated for the bucket in such a case, the corresponding call to kfree is moved from the algorithm-specific crush_destroy_bucket functions to the generic crush_destroy_bucket().
Product status
f24e9980eb860d8600cbe5ef3d2fd9295320d229 (git) before 6e70ef53e818c53eab28d7b0026b7fd03dddaba5
f24e9980eb860d8600cbe5ef3d2fd9295320d229 (git) before ebe76d58a48a48031b98543d86c4cd30a825b622
f24e9980eb860d8600cbe5ef3d2fd9295320d229 (git) before 3f42508191e129ee6b5ea96578d5cab14f2a013a
f24e9980eb860d8600cbe5ef3d2fd9295320d229 (git) before ea0d42137f0c06da71e37ffc647aab4c5309599a
f24e9980eb860d8600cbe5ef3d2fd9295320d229 (git) before cceb10023e76bc89f3fe9238ebd0ccab0fc7c7c5
f24e9980eb860d8600cbe5ef3d2fd9295320d229 (git) before 0f3604cbe4df14c5e58288ac9f57511e726a222d
f24e9980eb860d8600cbe5ef3d2fd9295320d229 (git) before fb176a99e4c1a5a8448a83d83d3606203ba81faa
f24e9980eb860d8600cbe5ef3d2fd9295320d229 (git) before 4c79fc2d598694bda845b46229c9d48b65042970
2.6.34
Any version before 2.6.34
5.10.258 (semver)
5.15.209 (semver)
6.1.175 (semver)
6.6.141 (semver)
6.12.91 (semver)
6.18.33 (semver)
7.0.10 (semver)
7.1 (original_commit_for_fix)
References
access.redhat.com/security/cve/CVE-2026-52955
bugzilla.redhat.com/show_bug.cgi?id=2492328 (RHBZ#2492328)
security.access.redhat.com/...2/vex/2026/cve-2026-52955.json
git.kernel.org/...c/6e70ef53e818c53eab28d7b0026b7fd03dddaba5
git.kernel.org/...c/ebe76d58a48a48031b98543d86c4cd30a825b622
git.kernel.org/...c/3f42508191e129ee6b5ea96578d5cab14f2a013a
git.kernel.org/...c/ea0d42137f0c06da71e37ffc647aab4c5309599a
git.kernel.org/...c/cceb10023e76bc89f3fe9238ebd0ccab0fc7c7c5
git.kernel.org/...c/0f3604cbe4df14c5e58288ac9f57511e726a222d
git.kernel.org/...c/fb176a99e4c1a5a8448a83d83d3606203ba81faa
git.kernel.org/...c/4c79fc2d598694bda845b46229c9d48b65042970