Linux Kernel libceph CVE-2026-68433

libceph is the in-kernel Ceph client library (drivers/block/rbd.c, net/ceph/) that implements the Ceph wire protocol between Linux clients and Ceph monitor/OSD clusters. MON_GET_VERSION_REPLY is a monitor reply message used to synchronize version numbers between client and monitor. The reply decode path in handle_get_version_reply() uses msg->front_alloc_len - a fixed allocation size representing the largest possible reused buffer - as the upper boundary passed to ceph_decode_need(). When a truncated reply arrives, front.iov_len (actual received bytes) is smaller than front_alloc_len, so the bounds check incorrectly permits a read into stale tail bytes from a prior message that occupied the same buffer. This is an instance of CWE-125 (Out-of-Bounds Read) combined with CWE-908 (Use of Uninitialized Resource): the second u64 decoded may contain kernel heap residue from an earlier network message. The fix aligns this handler with other libceph reply decoders by substituting front.iov_len for front_alloc_len, confining decodes strictly to received data.