CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode()

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

libceph: Fix potential out-of-bounds access in crush_decode()

A message of type CEPH_MSG_OSD_MAP containing a crush map with at least
one bucket has two fields holding the bucket algorithm. If the values
in these two fields differ, an out-of-bounds access can occur. This is
the case because the first algorithm field (alg) is used to allocate
the correct amount of memory for a bucket of this type, while the second
algorithm field inside the bucket (b->alg) is used in the subsequent
processing.

This patch fixes the issue by adding a check that compares alg and
b->alg and aborts the processing in case they differ. Furthermore,
b->alg is set to 0 in this case, because the destruction of the crush
map also uses this field to determine the bucket type, which can again
result in an out-of-bounds access when trying to free the memory pointed
to by the fields of the bucket. To correctly free the memory allocated
for the bucket in such a case, the corresponding call to kfree is moved
from the algorithm-specific crush_destroy_bucket functions to the
generic crush_destroy_bucket().

The Linux kernel CVE team has assigned CVE-2026-52955 to this issue.


Affected and fixed versions
===========================

	Fixed in 5.10.258 with commit 6e70ef53e818c53eab28d7b0026b7fd03dddaba5
	Fixed in 5.15.209 with commit ebe76d58a48a48031b98543d86c4cd30a825b622
	Fixed in 6.1.175 with commit 3f42508191e129ee6b5ea96578d5cab14f2a013a
	Fixed in 6.6.141 with commit ea0d42137f0c06da71e37ffc647aab4c5309599a
	Fixed in 6.12.91 with commit cceb10023e76bc89f3fe9238ebd0ccab0fc7c7c5
	Fixed in 6.18.33 with commit 0f3604cbe4df14c5e58288ac9f57511e726a222d
	Fixed in 7.0.10 with commit fb176a99e4c1a5a8448a83d83d3606203ba81faa
	Fixed in 7.1 with commit 4c79fc2d598694bda845b46229c9d48b65042970

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-52955
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ceph/crush/crush.c
	net/ceph/osdmap.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/6e70ef53e818c53eab28d7b0026b7fd03dddaba5
	https://git.kernel.org/stable/c/ebe76d58a48a48031b98543d86c4cd30a825b622
	https://git.kernel.org/stable/c/3f42508191e129ee6b5ea96578d5cab14f2a013a
	https://git.kernel.org/stable/c/ea0d42137f0c06da71e37ffc647aab4c5309599a
	https://git.kernel.org/stable/c/cceb10023e76bc89f3fe9238ebd0ccab0fc7c7c5
	https://git.kernel.org/stable/c/0f3604cbe4df14c5e58288ac9f57511e726a222d
	https://git.kernel.org/stable/c/fb176a99e4c1a5a8448a83d83d3606203ba81faa
	https://git.kernel.org/stable/c/4c79fc2d598694bda845b46229c9d48b65042970