CVE-2026-68159

In the Linux kernel, the following vulnerability has been resolved:

libceph: bound pg_{temp,upmap,upmapitems} length to CEPHPGMAXSIZE

__decodepgtemp() decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPHPGMAXSIZE. The helper backs both pgtemp and pgupmap decoding, and applyupmap()/gettemposds() later copy the decoded list into the fixed-size on-stack array struct cephosds.osds[CEPHPGMAXSIZE]. A monitor that sends an OSDMap with a pgtemp/pgupmap entry longer than 32 thus causes a stack out-of-bounds write.

An OSD set for a single PG can never exceed CEPHPGMAX_SIZE, so reject longer entries at decode time. The bound is well below the old overflow threshold, so it also covers the allocation-size overflow the previous check guarded against.

BUG: KASAN: stack-out-of-bounds in cephpgtoupactingosds Write of size 4 ... by task exploit kasanreport (mm/kasan/report.c:595) cephpgtoupactingosds (net/ceph/osdmap.c:2617 net/ceph/osdmap.c:2833) calctarget (net/ceph/osd_client.c:1638) __submitrequest (net/ceph/osdclient.c:2394) cephosdcstartrequest (net/ceph/osdclient.c:2490) cephosdccall (net/ceph/osdclient.c:5164) rbddevimageprobe (drivers/block/rbd.c:6899) dorbdadd (drivers/block/rbd.c:7138) ... kernel BUG at net/ceph/osdmap.c:2670!

[ idryomov: do the same in _decodepgupmapitems() ]