[SRU][Q][PATCH 0/1] CVE-2026-52955

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-52955

[ Impact ]

A message of type CEPH_MSG_OSD_MAP containing a crush map with at least one
bucket has two fields holding the bucket algorithm. If the values in these two
fields differ, an out-of-bounds access can occur, because the first algorithm
field (alg) is used to allocate memory for the bucket while the second field
(b->alg) is used in subsequent processing. The same mismatch can also trigger
an out-of-bounds access during destruction of the crush map, since b->alg is
used to determine the bucket type when freeing memory.

[ Fix ]

questing: clean cherry-pick
focal: clean cherry-pick
bionic: clean cherry-pick
xenial: clean cherry-pick
trusty: backported with AI-assisted adaptation

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A regression in this libceph/crush map decoding change could cause valid OSD
maps to be rejected or mishandled, or introduce memory handling errors when
parsing or freeing crush buckets, potentially affecting Ceph client
connectivity.