CVE-2026-80557

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

libceph: fix OOB read in decode_watchers() via missing bounds check

ceph_start_decoding() validates that struct_len bytes remain in the

buffer after the encoding header, but accepts struct_len=0 as valid:

ceph_decode_need(p, end, 0, bad) always passes. When a malicious or

compromised OSD sends an obj_list_watch_response_t reply with

struct_len=0, ceph_start_decoding() returns success with p == end,

leaving zero bytes guaranteed for subsequent reads.

The immediately following ceph_decode_32(p) in decode_watchers() has

no preceding bounds check. With p == end this is a 4-byte read past

the validated buffer boundary. The garbage value is then passed

directly to kzalloc_objs() as the watcher count.

The sibling function decode_watcher() already uses the safe variants

(ceph_decode_copy_safe, ceph_decode_64_safe, ceph_decode_skip_32)

after its own ceph_start_decoding() call. decode_watchers() is the

only site that uses th

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References