ACK: [SRU][Q][PATCH 0/1] CVE-2026-52955

[Tim Whisonant]

On Thu, Jul 16, 2026 at 04:12:25PM +0300, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-52955
> 
> [ Impact ]
> 
> A message of type CEPH_MSG_OSD_MAP containing a crush map with at least one
> bucket has two fields holding the bucket algorithm. If the values in these two
> fields differ, an out-of-bounds access can occur, because the first algorithm
> field (alg) is used to allocate memory for the bucket while the second field
> (b->alg) is used in subsequent processing. The same mismatch can also trigger
> an out-of-bounds access during destruction of the crush map, since b->alg is
> used to determine the bucket type when freeing memory.
> 
> [ Fix ]
> 
> questing: clean cherry-pick
> focal: clean cherry-pick
> bionic: clean cherry-pick
> xenial: clean cherry-pick
> trusty: backported with AI-assisted adaptation
> 
> [ Test Plan ]
> 
> Boot tested.
> 
> [ Where Problems Could Occur ]
> 
> A regression in this libceph/crush map decoding change could cause valid OSD
> maps to be rejected or mishandled, or introduce memory handling errors when
> parsing or freeing crush buckets, potentially affecting Ceph client
> connectivity.
> 

Acked-by: Tim Whisonant <tim.whisonant at canonical.com>