CVE-2026-43405

In the Linux kernel, the following vulnerability has been resolved:

libceph: Use u32 for non-negative values in ceph_monmap_decode()

This patch fixes unnecessary implicit conversions that change signedness

of blob_len and num_mon in ceph_monmap_decode().

Currently blob_len and num_mon are (signed) int variables. They are used

to hold values that are always non-negative and get assigned in

ceph_decode_32_safe(), which is meant to assign u32 values. Both

variables are subsequently used as unsigned values, and the value of

num_mon is further assigned to monmap->num_mon, which is of type u32.

Therefore, both variables should be of type u32. This is especially

relevant for num_mon. If the value read from the incoming message is

very large, it is interpreted as a negative value, and the check for

num_mon > CEPH_MAX_MON does not catch it. This leads to the attempt to

allocate a very large chunk of memory for monmap, which will most likely

fail. In this case, an unnecessary attempt to allocate memory is

performed, and -ENOMEM is returned instead of -EINVAL.