DEBIAN-CVE-2026-68159

In the Linux kernel, the following vulnerability has been resolved:  libceph: bound pg{temp,upmap,upmapitems} length to CEPHPGMAXSIZE  decodepgtemp() decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPHPGMAXSIZE. The helper backs both pgtemp and pgupmap decoding, and applyupmap()/gettemposds() later copy the decoded list into the fixed-size on-stack array struct cephosds.osds[CEPHPGMAXSIZE]. A monitor that sends an OSDMap with a pgtemp/pgupmap entry longer than 32 thus causes a stack out-of-bounds write.  An OSD set for a single PG can never exceed CEPHPGMAXSIZE, so reject longer entries at decode time. The bound is well below the old overflow threshold, so it also covers the allocation-size overflow the previous check guarded against.    BUG: KASAN: stack-out-of-bounds in cephpgtoupactingosds   Write of size 4 ... by task exploit    kasanreport (mm/kasan/report.c:595)    cephpgtoupactingosds (net/ceph/osdmap.c:2617 net/ceph/osdmap.c:2833)    calctarget (net/ceph/osdclient.c:1638)    submitrequest (net/ceph/osdclient.c:2394)    cephosdcstartrequest (net/ceph/osdclient.c:2490)    cephosdccall (net/ceph/osdclient.c:5164)    rbddevimageprobe (drivers/block/rbd.c:6899)    dorbdadd (drivers/block/rbd.c:7138)    ...   kernel BUG at net/ceph/osdmap.c:2670!  [ idryomov: do the same in decodepgupmapitems() ]