Linux kernel libceph: out-of-bounds read in decode_watchers() from a zero-length struct_len

Impact

ceph_start_decoding() accepts struct_len=0 as valid, returning success with the cursor already at the end of the buffer. decode_watchers() then calls the unchecked ceph_decode_32(p) - unlike its sibling decode_watcher(), which uses the safe variants - so a reply with struct_len=0 produces a 4-byte read past the validated buffer and feeds the garbage value to kzalloc_objs() as the watcher count. The commit states the attacker model explicitly: a malicious or compromised OSD in a multi-tenant Ceph deployment can trigger this against any kernel client that issues LIST_WATCHERS, needing nothing beyond OSD session establishment. For an operator running RBD or CephFS from GPU nodes, that means a single compromised storage daemon can read out of bounds and drive an attacker-influenced allocation size in every client kernel that talks to it.

Who can reach it

A malicious or compromised OSD reachable by the kernel Ceph client on the storage network, with only a normal OSD session established. Triggered when the client issues CEPH_OSD_OP_LIST_WATCHERS. No local user action and no client-side authentication weakness is needed.

What to do

Apply the stable fix, which replaces the bare ceph_decode_32(p) with ceph_decode_32_safe(p, end, ...) matching the pattern used elsewhere in the file; two stable commits are listed and the record names no fixed release. Rollout is a patched kernel plus a per-node reboot on every host with a kernel Ceph client, so drain GPU workloads first. Until then, the exposure is bounded by how well the storage network and OSD hosts are isolated from tenant workloads.

References

Related entries

• Linux kernel libceph: unvalidated primary_temp OSD index causes out-of-bounds array readsCVE-2026-80558 · Linux kernel libceph (get_temp_osds(), unvalidated primary_temp OSD index)Unscored
• Linux kernel libceph: unchecked decodes in decode_locker() let a malicious OSD read out of boundsCVE-2026-80561 · Linux kernel libceph (cls_lock_client decode_locker)Unscored
• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical
• Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the hostCVE-2026-48751 · Incus (instance snapshots ignore restricted.containers.lowlevel)Critical
• VMware ESXi (OpenSLP): Use-after-free in OpenSLP on port 427 - unauthenticated remote code execution on the hypervisorCVE-2020-3992 · VMware ESXi (OpenSLP)Critical
• Linux kernel mlx5_core kTLS RX offload: TLS RX resync list corruption: entries are moved by the resync handlerCVE-2021-47215 · Linux kernel mlx5_core kTLS RX offloadCritical