{"apiVersion":"1.0","identifier":"CVE-2026-80557","description":"In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decode_watchers() via missing bounds check ceph_start_decoding() validates that struct_len bytes remain in the buffer after the encoding header, but accepts struct_len=0 as valid: ceph_decode_need(p, end, 0, bad) always passes. When a malicious or compromised OSD sends an obj_list_watch_response_t reply with struct_len=0, ceph_start_decoding() returns success with p == end, leaving zero bytes guaranteed for subsequent reads. The immediately following ceph_decode_32(p) in decode_watchers() has no preceding bounds check. With p == end this is a 4-byte read past the validated buffer boundary. The garbage value is then passed directly to kzalloc_objs() as the watcher count. The sibling function decode_watcher() already uses the safe variants (ceph_decode_copy_safe, ceph_decode_64_safe, ceph_decode_skip_32) after its own ceph_start_decoding() call. decode_watchers() is the only site that uses the bare variant, confirming an oversight. Fix by replacing ceph_decode_32(p) with ceph_decode_32_safe(p, end, *num_watchers, bad), consistent with the established pattern. Attacker model: a malicious or compromised OSD in a multi-tenant Ceph deployment (e.g. cloud) can trigger this against any kernel client that calls CEPH_OSD_OP_LIST_WATCHERS, without any further privileges beyond OSD session establishment. [ idryomov: trim changelog ]","publishedAt":"2026-08-26T15:17:10","lastModifiedAt":"2026-08-27T13:18:40","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-80557","cvssScore":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00521,"riskScore":1.03,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-80557","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-80557","en":"https://www.redsauce.net/en/cves/CVE-2026-80557","fr":"https://www.redsauce.net/fr/cves/CVE-2026-80557","pt":"https://www.redsauce.net/pt/cves/CVE-2026-80557","de":"https://www.redsauce.net/de/cves/CVE-2026-80557","sk":"https://www.redsauce.net/sk/cves/CVE-2026-80557","el":"https://www.redsauce.net/el/cves/CVE-2026-80557"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-80557"}}