CVE-2026-43405

In the Linux kernel, the following vulnerability has been resolved:

libceph: Use u32 for non-negative values in cephmonmapdecode()

This patch fixes unnecessary implicit conversions that change signedness of bloblen and nummon in cephmonmapdecode(). Currently bloblen and nummon are (signed) int variables. They are used to hold values that are always non-negative and get assigned in cephdecode32safe(), which is meant to assign u32 values. Both variables are subsequently used as unsigned values, and the value of nummon is further assigned to monmap->nummon, which is of type u32. Therefore, both variables should be of type u32. This is especially relevant for nummon. If the value read from the incoming message is very large, it is interpreted as a negative value, and the check for nummon > CEPHMAX_MON does not catch it. This leads to the attempt to allocate a very large chunk of memory for monmap, which will most likely fail. In this case, an unnecessary attempt to allocate memory is performed, and -ENOMEM is returned instead of -EINVAL.