APPLIED[N:hwe-6.17]: [SRU][Q][PATCH 0/1] CVE-2026-52955

[Edoardo Canepa]

Applied to. Thanks.

On 7/16/26 15:12, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-52955
>
> [ Impact ]
>
> A message of type CEPH_MSG_OSD_MAP containing a crush map with at least one
> bucket has two fields holding the bucket algorithm. If the values in these two
> fields differ, an out-of-bounds access can occur, because the first algorithm
> field (alg) is used to allocate memory for the bucket while the second field
> (b->alg) is used in subsequent processing. The same mismatch can also trigger
> an out-of-bounds access during destruction of the crush map, since b->alg is
> used to determine the bucket type when freeing memory.
>
> [ Fix ]
>
> questing: clean cherry-pick
> focal: clean cherry-pick
> bionic: clean cherry-pick
> xenial: clean cherry-pick
> trusty: backported with AI-assisted adaptation
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> A regression in this libceph/crush map decoding change could cause valid OSD
> maps to be rejected or mishandled, or introduce memory handling errors when
> parsing or freeing crush buckets, potentially affecting Ceph client
> connectivity.
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260730/db1ae6cc/attachment.sig>