CVE-2026-80557

A flaw was found in the kernel's libceph component. A malicious or compromised Ceph Object Storage Daemon (OSD) can send a specially crafted message that causes an out-of-bounds read when processing watcher information. This vulnerability can lead to memory corruption or a denial of service, affecting kernel clients in multi-tenant Ceph deployments.

A moderate out-of-bounds read flaw was found in the Linux kernel's libceph implementation. When a kernel Ceph client issues a CEPH_OSD_OP_LIST_WATCHERS operation, ceph_start_decoding() accepts a reply with struct_len=0 from a Ceph Object Storage Daemon (OSD), after which the unchecked ceph_decode_32() in decode_watchers() reads 4 bytes past the validated buffer boundary; the garbage value read is then used as the watcher count for allocation. A malicious or compromised OSD in a Ceph storage cluster can exploit this to crash the kernel client (denial of service), with a potential for limited information disclosure from kernel memory. Because exploitation requires control or compromise of an OSD within the normally restricted storage network, and the primary consequence is loss of availability of the client, Red Hat rates this flaw Moderate with a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). This differs significantly from the upstream CVE record's Critical 9.8 score, which assumes an unauthenticated network attacker with high confidentiality, integrity, and availability impact that the technical evidence does not support. The vulnerable code is present in the kernel and kernel-rt components of Red Hat Enterprise Linux 7, 8, 9, and 10, and in Red Hat In-Vehicle OS 2 streams; Red Hat Enterprise Linux 6 is not affected because the vulnerable code is not present in that stream. As the risk is limited to environments where an attacker already controls a trusted storage node, the fix has been deferred to a future update for the affected streams; the residual risk remains a kernel panic or denial of service on Ceph kernel clients that list watchers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.