EUVD-2026-66472
GHSA-j5wf-cpjp-5vx9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AC:H and network delivery reflect the required malicious-OSD-server position; C:L for a 4-byte OOB read and A:L for a possible oversized allocation; no integrity impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
libceph: fix OOB read in decode_watchers() via missing bounds check
ceph_start_decoding() validates that struct_len bytes remain in the buffer after the encoding header, but accepts struct_len=0 as valid: ceph_decode_need(p, end, 0, bad) always passes. When a malicious or compromised OSD sends an obj_list_watch_response_t reply with struct_len=0, ceph_start_decoding() returns success with p == end, leaving zero bytes guaranteed for subsequent reads.
The immediately following ceph_decode_32(p) in decode_watchers() has no preceding bounds check. With p == end this is a 4-byte read past the validated buffer boundary. The garbage value is then passed directly to kzalloc_objs() as the watcher count.
The sibling function decode_watcher() already uses the safe variants (ceph_decode_copy_safe, ceph_decode_64_safe, ceph_decode_skip_32) after its own ceph_start_decoding() call. decode_watchers() is the only site that uses the bare variant, confirming an oversight.
Fix by replacing ceph_decode_32(p) with ceph_decode_32_safe(p, end, *num_watchers, bad), consistent with the established pattern.
Attacker model: a malicious or compromised OSD in a multi-tenant Ceph deployment (e.g. cloud) can trigger this against any kernel client that calls CEPH_OSD_OP_LIST_WATCHERS, without any further privileges beyond OSD session establishment.
[ idryomov: trim changelog ]
AnalysisAI
Out-of-bounds kernel memory read in the Linux kernel's libceph client (decode_watchers()) lets a malicious or compromised Ceph OSD trigger a 4-byte read past a validated buffer when it returns an obj_list_watch_response_t reply with struct_len=0. Any kernel client issuing CEPH_OSD_OP_LIST_WATCHERS is affected; the leaked garbage value is then used as a watcher count for allocation, risking information disclosure or unstable allocation behavior. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to control or compromise a Ceph OSD that the victim kernel client has an established session with, and the victim client must invoke CEPH_OSD_OP_LIST_WATCHERS (kernel RBD/CephFS list-watchers operation). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) substantially overstates real-world impact and should be treated with caution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | In a multi-tenant cloud Ceph deployment, an attacker who controls or compromises an OSD waits for a kernel client to issue a CEPH_OSD_OP_LIST_WATCHERS request, then replies with a crafted obj_list_watch_response_t whose struct_len=0. The client's decode_watchers() reads 4 bytes of adjacent kernel memory past the buffer and feeds that value into kzalloc_objs(), potentially leaking data or causing an unstable oversized allocation. … |
| Remediation | Upstream fix available (stable commits 7130d94846dadbb97b6b7f4d78a3a7bba6e3daa1 and 00ead17c7de137a692edee59f2772e6af687e8eb); a released patched version is not independently confirmed from the input, though EUVD references stable lines near 7.1.10 and 7.2 - update to your distribution's kernel build that incorporates these commits and reboot. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all Linux systems in your infrastructure that connect to Ceph OSD servers (common in cloud storage environments) and check vendor advisories for available kernel patches. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today