CVE-2026-68158

In the Linux kernel, the following vulnerability has been resolved:

libceph: Fix multiplication overflow in decodenewupstateweight()

If a message of type CEPHMSGOSD_MAP contains a (maliciously) corrupted

osdmap, out-of-bounds memory accesses may occur in

decodenewupstateweight(). This happens because the bounds check for

the new_state part is based on calculating its length depending on a len

value read from the incoming message. This calculation may overflow

leading to an incorrect bounds check. Subsequently, out-of-bounds reads

may occur when decoding this part.

This patch switches the multiplication to use checkmuloverflow() to

abort processing the osdmap if an overflow occurred. Therefore,

osdmaps/messages containing large values for len that result in a

multiplication overflow are treated as invalid.

[ idryomov: rename newstatelen -> newstateitem_size, formatting ]