Executive brief
The Linux kernel's Ceph client library contains an out-of-bounds memory read vulnerability in the decode_watchers() function. A malicious or compromised Ceph object storage daemon (OSD) can send a specially crafted response that causes a kernel client to read garbage data from memory, potentially leading to memory corruption, information disclosure, or denial of service in systems using Ceph storage.
Technical details
The vulnerability is a missing bounds check in the decode_watchers() function within net/ceph/osd_client.c. The function calls ceph_start_decoding() with a struct_len value of 0, which passes validation but leaves the buffer pointer at the end boundary. The subsequent ceph_decode_32(p) call lacks a bounds check and reads 4 bytes past the validated buffer boundary, obtaining garbage data used as a watcher count. The sibling function decode_watcher() correctly uses safe variants (ceph_decode_32_safe). Attack requires a malicious or compromised OSD in a multi-tenant Ceph deployment to send a crafted obj_list_watch_response_t reply with struct_len=0 to any kernel client calling CEPH_OSD_OP_LIST_WATCHERS. The fix replaces ceph_decode_32(p) with ceph_decode_32_safe(p, end, *num_watchers, bad) to enforce bounds checking. Patches are available in upstream kernel and stable releases.
Affected products
- Linux Linux kernel Multiple versions prior to patched release (see git.kernel.org); affects all versions with libceph support and CEPH_OSD_OP_LIST_WATCHERS implementation
Timeline
- 2026-08-26: disclosed: CVE published
- 2026-08-12: patched: Fix committed to kernel by Ilya Dryomov
- 2026-07-08: other: Vulnerability discovered by Pavitra Jha