Executive brief
The Linux kernel's Ceph client library (libceph) contains a flaw in how it processes version replies from Ceph monitors. When a truncated or malformed reply is received, the vulnerable code reads uninitialized data from stale buffer contents, potentially exposing sensitive kernel memory. This could allow an attacker with network access to a Ceph cluster to leak kernel memory or trigger unexpected behavior.
Technical details
The vulnerability exists in the handle_get_version_reply() function in net/ceph/mon_client.c, which uses msg->front_alloc_len as the decode boundary instead of msg->front.iov_len. The front_alloc_len field represents the allocated size of the reused reply buffer, not the number of bytes actually received from the network. A truncated MON_GET_VERSION_REPLY can pass ceph_decode_need() validation and decode a u64 value from stale tail bytes left in the buffer by an earlier message, resulting in an uninitialized memory read. The fix changes the decode boundary to msg->front.iov_len, matching the actual received byte count and aligning with other libceph reply handlers. This is a network-based vulnerability requiring an attacker to send a crafted Ceph protocol message, with no authentication preconditions in the message handling path.
Affected products
- Linux Linux kernel Multiple versions from 3.x through 6.x (libceph component affected across stable series)
Timeline
- 2026-08-12: disclosed
- 2026-06-07: patched: Upstream fix commit d3c32939fa0e3ee9b883b9a0fd1972c5c444e3d0