ACK: [SRU][Q][PATCH 0/1] CVE-2026-52958

[Alessio Faina]

On Thu, Jul 16, 2026 at 03:32:07PM +0300, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-52958
> 
> [ Impact ]
> 
> When decoding osd_state and osd_weight from an incoming osdmap in
> osdmap_decode(), both are decoded for each osd, i.e., map->max_osd times. The
> ceph_decode_need() check only accounts for sizeof(*map->osd_weight) once. This
> can potentially result in an out-of-bounds memory access if the incoming
> message is corrupted such that the max_osd value exceeds the actual content of
> the osdmap message.
> 
> [ Fix ]
> 
> questing: clean cherry-pick
> focal: clean cherry-pick
> 
> [ Test Plan ]
> 
> Boot tested.
> 
> [ Where Problems Could Occur ]
> 
> A regression in this fix could affect the libceph subsystem's osdmap decoding,
> potentially causing valid osdmap messages to be rejected or mishandled during
> decode. This could impact Ceph client connectivity and mount reliability.
> 
> -- 
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team

Acked-by: Alessio Faina <alessio.faina at canonical.com>