CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode()

CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode()

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

libceph: Fix potential out-of-bounds access in osdmap_decode()

When decoding osd_state and osd_weight from an incoming osdmap in
osdmap_decode(), both are decoded for each osd, i.e., map->max_osd
times. The ceph_decode_need() check only accounts for
sizeof(*map->osd_weight) once. This can potentially result in an
out-of-bounds memory access if the incoming message is corrupted such
that the max_osd value exceeds the actual content of the osdmap message.

This patch fixes the issue by changing the corresponding part in the
ceph_decode_need() check to account for
map->max_osd*sizeof(*map->osd_weight).

The Linux kernel CVE team has assigned CVE-2026-52958 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.3 with commit dcbc919a5dc8c2629684a113a90c0b6fe10c3462 and fixed in 5.10.258 with commit 36a79759a288961b1ff28a68ec2d1f56f6848098
	Issue introduced in 5.3 with commit dcbc919a5dc8c2629684a113a90c0b6fe10c3462 and fixed in 5.15.209 with commit 3f2575bb7f955d42569d96c3e04fa958a0dcf4b4
	Issue introduced in 5.3 with commit dcbc919a5dc8c2629684a113a90c0b6fe10c3462 and fixed in 6.1.175 with commit 8713bbc4b2b9ad78f803978e54b7e49dd21bd9be
	Issue introduced in 5.3 with commit dcbc919a5dc8c2629684a113a90c0b6fe10c3462 and fixed in 6.6.141 with commit 0d2dd7e6bb74fd7712aa73457a4a821906c6863a
	Issue introduced in 5.3 with commit dcbc919a5dc8c2629684a113a90c0b6fe10c3462 and fixed in 6.12.91 with commit e7187f33c02488697ec0d01d82bf7a3f8deaba8f
	Issue introduced in 5.3 with commit dcbc919a5dc8c2629684a113a90c0b6fe10c3462 and fixed in 6.18.33 with commit 48df98d12b15360cd56af5c1f460307b340c1197
	Issue introduced in 5.3 with commit dcbc919a5dc8c2629684a113a90c0b6fe10c3462 and fixed in 7.0.10 with commit ee933694645dac062d65fc2743f92bc06fa0db6b
	Issue introduced in 5.3 with commit dcbc919a5dc8c2629684a113a90c0b6fe10c3462 and fixed in 7.1 with commit 35d0ed82d03e5ee77ea4f31f20e29562a7721649

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-52958
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ceph/osdmap.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/36a79759a288961b1ff28a68ec2d1f56f6848098
	https://git.kernel.org/stable/c/3f2575bb7f955d42569d96c3e04fa958a0dcf4b4
	https://git.kernel.org/stable/c/8713bbc4b2b9ad78f803978e54b7e49dd21bd9be
	https://git.kernel.org/stable/c/0d2dd7e6bb74fd7712aa73457a4a821906c6863a
	https://git.kernel.org/stable/c/e7187f33c02488697ec0d01d82bf7a3f8deaba8f
	https://git.kernel.org/stable/c/48df98d12b15360cd56af5c1f460307b340c1197
	https://git.kernel.org/stable/c/ee933694645dac062d65fc2743f92bc06fa0db6b
	https://git.kernel.org/stable/c/35d0ed82d03e5ee77ea4f31f20e29562a7721649