Linux kernel libceph: out-of-bounds read in decode_watchers() from a zero-length struct_len

Impact

ceph_start_decoding() accepts struct_len=0 as valid, returning success with the cursor already at the end of the buffer. decode_watchers() then calls the unchecked ceph_decode_32(p) - unlike its sibling decode_watcher(), which uses the safe variants - so a reply with struct_len=0 produces a 4-byte read past the validated buffer and feeds the garbage value to kzalloc_objs() as the watcher count. The commit states the attacker model explicitly: a malicious or compromised OSD in a multi-tenant Ceph deployment can trigger this against any kernel client that issues LIST_WATCHERS, needing nothing beyond OSD session establishment. For an operator running RBD or CephFS from GPU nodes, that means a single compromised storage daemon can read out of bounds and drive an attacker-influenced allocation size in every client kernel that talks to it.

Who can reach it

A malicious or compromised OSD reachable by the kernel Ceph client on the storage network, with only a normal OSD session established. Triggered when the client issues CEPH_OSD_OP_LIST_WATCHERS. No local user action and no client-side authentication weakness is needed.

What to do

Apply the stable fix, which replaces the bare ceph_decode_32(p) with ceph_decode_32_safe(p, end, ...) matching the pattern used elsewhere in the file; two stable commits are listed and the record names no fixed release. Rollout is a patched kernel plus a per-node reboot on every host with a kernel Ceph client, so drain GPU workloads first. Until then, the exposure is bounded by how well the storage network and OSD hosts are isolated from tenant workloads.

References

Related entries

• Linux kernel libceph: unvalidated primary_temp OSD index causes out-of-bounds array readsCVE-2026-80558 · Linux kernel libceph (get_temp_osds(), unvalidated primary_temp OSD index)Unscored
• Linux kernel libceph: unchecked decodes in decode_locker() let a malicious OSD read out of boundsCVE-2026-80561 · Linux kernel libceph (cls_lock_client decode_locker)Unscored
• Linux kernel AMD LBR: user-only branch sampling leaks kernel addresses to unprivileged usersCVE-2026-80602 · Linux kernel perf/x86/amd/lbr (AMD LBR v2 branch stack filtering)Unscored
• Linux kernel iommufd: dma_buf_unpin() without dma_resv lock warns on every DMABUF IOAS teardownCVE-2026-80633 · Linux kernel iommufd (DMABUF-backed iopt_pages release path)Unscored
• Linux kernel CXL fwctl: supported-features query trips a fortify panic and takes the host downCVE-2026-80640 · Linux kernel cxl_core (fwctl get-supported-features path)Unscored
• Linux ccp/SEV: zero-length cert chain in PDH export hits a BUG_ON on CONFIG_DEBUG_VIRTUAL kernelsCVE-2026-80652 · Linux kernel crypto/ccp AMD PSP driver (SEV PDH export ioctl)Unscored