CVE-2026-80557 Overview
CVE-2026-80557 is an out-of-bounds read vulnerability in the Linux kernel's libceph module, specifically in the decode_watchers() function. The flaw stems from a missing bounds check when parsing obj_list_watch_response_t replies from a Ceph Object Storage Daemon (OSD). A malicious or compromised OSD can send a reply with struct_len=0, causing ceph_start_decoding() to return success while leaving zero bytes available for subsequent reads. The following ceph_decode_32(p) call then reads 4 bytes past the validated buffer boundary, and the garbage value is passed to kzalloc_objs() as the watcher count.
Critical Impact
A malicious or compromised OSD in a multi-tenant Ceph deployment can trigger memory corruption in any kernel client that issues CEPH_OSD_OP_LIST_WATCHERS, requiring only an established OSD session.
Affected Products
- Linux kernel libceph subsystem (Ceph client)
- Kernel builds prior to the fix commits referenced in the stable tree
- Systems using kernel-mode Ceph clients (e.g., krbd, ceph.ko) against untrusted OSDs
Discovery Timeline
- 2026-08-26 - CVE-2026-80557 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-80557
Vulnerability Analysis
The defect lives in decode_watchers() inside the Linux libceph decoder path. ceph_start_decoding() validates that struct_len bytes remain in the buffer after the encoding header, but it accepts struct_len=0 as valid because ceph_decode_need(p, end, 0, bad) unconditionally passes. When the reply carries struct_len=0, the decoder returns success with the pointer p equal to end, meaning zero bytes are guaranteed for further reads.
The immediately following ceph_decode_32(p) in decode_watchers() performs no bounds check. With p == end, this results in a 4-byte read past the validated buffer boundary, classified as an Out-of-Bounds Read [CWE-125]. The attacker-influenced garbage value is then handed to kzalloc_objs() as the watcher count, producing a large or attacker-shaped allocation that governs subsequent parsing.
Root Cause
The root cause is inconsistent use of safe decoding primitives. The sibling function decode_watcher() already uses ceph_decode_copy_safe, ceph_decode_64_safe, and ceph_decode_skip_32 after its own ceph_start_decoding() call. decode_watchers() was the only site still using the bare ceph_decode_32(p) variant, which does not re-validate that four bytes remain readable.
Attack Vector
The attacker model is a malicious or compromised OSD in a multi-tenant Ceph deployment such as a shared cloud storage tier. No privileges are required beyond establishing an OSD session with the victim kernel client. Any kernel client that calls CEPH_OSD_OP_LIST_WATCHERS can be targeted by returning a crafted obj_list_watch_response_t reply with struct_len=0, resulting in an out-of-bounds read and subsequent memory corruption paths.
The fix replaces ceph_decode_32(p) with ceph_decode_32_safe(p, end, *num_watchers, bad), aligning decode_watchers() with the safe-decoding pattern used elsewhere in the module. See the Kernel Commit c59219a6 for the canonical fix.
Detection Methods for CVE-2026-80557
Indicators of Compromise
- Kernel logs showing crashes, KASAN reports, or oops traces originating from decode_watchers or libceph decode paths.
- Unexpected large or failed allocations attributable to kzalloc calls following CEPH_OSD_OP_LIST_WATCHERS operations.
- Ceph clients repeatedly disconnecting from a specific OSD immediately after issuing list-watchers requests.
Detection Strategies
- Enable KASAN on test kernels to catch out-of-bounds reads in libceph before rollout.
- Audit installed kernel versions against the stable commits c59219a6, 00ead17c, 1c824e7c, 7130d948, 85479b7d, cb8246e5, eab3eeb6, and f161be39.
- Correlate Ceph OSD session logs with kernel crash telemetry to identify anomalous OSD replies preceding client instability.
Monitoring Recommendations
- Ingest kernel ring buffer and dmesg output into a central data lake to identify libceph decode failures across the fleet.
- Monitor OSD-to-client traffic for malformed obj_list_watch_response_t payloads with struct_len=0.
- Alert on repeated kernel client reconnections to the same OSD, which may indicate exploitation attempts.
How to Mitigate CVE-2026-80557
Immediate Actions Required
- Upgrade to a Linux kernel that includes the upstream fix or the corresponding stable backport for your branch.
- Inventory hosts running kernel-mode Ceph clients (krbd, CephFS kernel client) and prioritize those in multi-tenant environments.
- Restrict OSD peers to trusted infrastructure until patching is complete, particularly in shared cloud tenancies.
Patch Information
The fix replaces the unsafe ceph_decode_32(p) call with ceph_decode_32_safe(p, end, *num_watchers, bad) in decode_watchers(). Backports are available across multiple stable branches. See the fix commits: 00ead17c, 1c824e7c, 7130d948, 85479b7d, c59219a6, cb8246e5, eab3eeb6, and f161be39.
Workarounds
- Avoid issuing CEPH_OSD_OP_LIST_WATCHERS from unpatched kernel clients where feasible.
- Segment Ceph clusters so kernel clients only communicate with trusted, first-party OSDs.
- Prefer user-space Ceph clients (librados/librbd) on unpatched hosts when the same functionality is required, since the vulnerable code path is in the kernel decoder.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
