CVE-2026-80557

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read exists in the libceph component. The ceph start decoding() function allows a struct len value of 0, which can lead to a situation where no bytes are guaranteed for subsequent reads. Consequently, the decode watchers() function performs a 4-byte read past the validated buffer boundary using ceph decode 32(p) because it lacks a preceding bounds check. This allows a malicious or compromised Object Storage Device (OSD) in a multi-tenant Ceph deployment to trigger the issue against any kernel client that calls CEPH OSD OP LIST WATCHERS after establishing an OSD session.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.