CVE-2026-68159

In the Linux kernel, the following vulnerability has been resolved:

libceph: bound pg{temp,upmap,upmapitems} length to CEPHPGMAX_SIZE

_decodepg_temp() decodes an user-controlled length but only rejects

values large enough to overflow the allocation; it does not bound it to

CEPHPGMAXSIZE. The helper backs both pgtemp and pg_upmap decoding, and

applyupmap()/gettemp_osds() later copy the decoded list into the fixed-size

on-stack array struct cephosds.osds[CEPHPGMAXSIZE]. A monitor that sends

an OSDMap with a pgtemp/pgupmap entry longer than 32 thus causes a stack

out-of-bounds write.

An OSD set for a single PG can never exceed CEPHPGMAX_SIZE, so reject longer

entries at decode time. The bound is well below the old overflow threshold, so

it also covers the allocation-size overflow the previous check guarded against.

  BUG: KASAN: stack-out-of-bounds in cephpgtoupacting_osds

  Write of size 4 ... by task exploit

   kasan_report (mm/kasan/report.c:595)

   cephpgtoupacting_osds (net/ceph/osdmap.c:2617 net/ceph/osdmap.c:2833)

   calctarget (net/ceph/osdclient.c:1638)

   _submitrequest (net/ceph/osd_client.c:2394)

   cephosdcstartrequest (net/ceph/osdclient.c:2490)

   cephosdccall (net/ceph/osd_client.c:5164)

   rbddevimage_probe (drivers/block/rbd.c:6899)

   dorbdadd (drivers/block/rbd.c:7138)

   ...

  kernel BUG at net/ceph/osdmap.c:2670!

[ idryomov: do the same in _decodepgupmapitems() ]