CVE-2026-80557

Received Received - Intake

Out-of-Bounds Read in Linux Kernel Ceph Client

Publication date: 2026-08-26

Last updated on: 2026-08-27

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decode_watchers() via missing bounds check ceph_start_decoding() validates that struct_len bytes remain in the buffer after the encoding header, but accepts struct_len=0 as valid: ceph_decode_need(p, end, 0, bad) always passes. When a malicious or compromised OSD sends an obj_list_watch_response_t reply with struct_len=0, ceph_start_decoding() returns success with p == end, leaving zero bytes guaranteed for subsequent reads. The immediately following ceph_decode_32(p) in decode_watchers() has no preceding bounds check. With p == end this is a 4-byte read past the validated buffer boundary. The garbage value is then passed directly to kzalloc_objs() as the watcher count. The sibling function decode_watcher() already uses the safe variants (ceph_decode_copy_safe, ceph_decode_64_safe, ceph_decode_skip_32) after its own ceph_start_decoding() call. decode_watchers() is the only site that uses the bare variant, confirming an oversight. Fix by replacing ceph_decode_32(p) with ceph_decode_32_safe(p, end, *num_watchers, bad), consistent with the established pattern. Attacker model: a malicious or compromised OSD in a multi-tenant Ceph deployment (e.g. cloud) can trigger this against any kernel client that calls CEPH_OSD_OP_LIST_WATCHERS, without any further privileges beyond OSD session establishment. [ idryomov: trim changelog ]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-27

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-80557

EUVD

EUVD-2026-66472

Affected Vendors & Products

Vendor	Product	Version / Range
ceph	ceph	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a buffer overflow vulnerability in the Linux kernel's Ceph client implementation. It occurs when processing watcher responses from a Ceph OSD (Object Storage Daemon). The issue stems from missing bounds checking when struct_len=0 is accepted as valid, leading to a 4-byte read past the buffer boundary in decode_watchers(). This can result in memory corruption and potential arbitrary code execution.

Detection Guidance

This vulnerability is specific to the Linux kernel's Ceph client implementation and requires kernel-level inspection. Detection involves checking kernel logs for crashes or memory corruption after Ceph operations, particularly those involving watchers. Commands like dmesg | grep -i ceph or journalctl -k | grep -i ceph may reveal errors. No direct network commands detect this as it requires malicious OSD interaction.

Impact Analysis

If you use a Ceph cluster with kernel clients, a malicious or compromised OSD could exploit this to crash the client kernel or execute arbitrary code with kernel privileges. This could lead to denial of service or full system compromise on affected systems.

Compliance Impact

This vulnerability allows a malicious or compromised OSD to trigger an out-of-bounds read in the Linux kernel's Ceph client, potentially leading to memory corruption or unauthorized data access. For compliance with GDPR or HIPAA, such vulnerabilities could result in unauthorized data exposure or processing, violating principles of data protection and confidentiality.

Mitigation Strategies

Apply the Linux kernel patch that replaces unsafe ceph_decode_32() with ceph_decode_32_safe() in decode_watchers(). Update Ceph client software to the fixed version. Monitor kernel logs for crashes or memory corruption after Ceph operations. Ensure OSDs are from trusted sources to prevent malicious interactions.

Hi! I’m here to help you understand CVE-2026-80557. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70