External risk intelligence

Linux Kernel libceph Out-of-Bounds Read leads to watcher count corruption.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-80557

The vulnerability exists in the Linux kernel's Ceph client implementation, which processes communications from OSDs (Object Storage Devices). While network-reachable within a storage cluster, OSD communication typically occurs over dedicated, internal, or isolated storage networks rather than directly exposed public internet interfaces.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Linux kernel's Ceph client could allow a malicious or compromised storage device to read data beyond its allocated buffer. This could potentially impact data integrity and availability within storage systems that utilize this technology. The primary concern at this time is to confirm if your environment utilizes the affected components and assess any potential exposure.

A storage system flaw allows unintended data access.
Understand potential data integrity and availability risks.
Confirm relevance to confirm exposure and manage risk.

Attack Path

How an attacker could exploit the issue

An attacker with control over a storage device in a multi-tenant environment could send a specially crafted response to a client. This response, when processed by the Linux kernel's Ceph component, would lead to an out-of-bounds read. The vulnerability arises from insufficient bounds checking after a buffer length is initially validated, potentially allowing the attacker to influence critical data structures.

Requires OSD session establishment.
Triggered by malformed OSD response.
Leads to memory corruption and crashes.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect kernel clients that interact with Ceph, specifically when processing list watcher responses. A malicious or compromised OSD could send a malformed response, causing an out-of-bounds read in the kernel's Ceph client. This could lead to unexpected behavior or a crash of the client system when handling watcher information.

Kernel client watcher data.
Malformed OSD response triggers out-of-bounds read.
Potential for client system instability.

Operational Fix

Recommended remediation, mitigation, and detection steps

A malicious or compromised OSD in a multi-tenant Ceph deployment can trigger this vulnerability against any kernel client calling CEPH_OSD_OP_LIST_WATCHERS. The first practical step is to identify where this Linux kernel functionality is deployed, confirm its reachability and business criticality, and then assign ownership to the appropriate team for remediation planning.

Own by Linux kernel/Ceph implementation team.
Verify OSD reachability and client impact.
Plan remediation via kernel update.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel libceph component?

Libceph is the kernel-level client component used by Linux systems to communicate with Ceph storage clusters. It allows servers and applications to interact with distributed storage, handling operations like reading, writing, and listing watchers on stored objects. This library is essential for integrating Linux clients into large-scale, software-defined storage environments where data is spread across many nodes.

What does this CVE-2026-80557 out-of-bounds read mean?

This is a memory safety flaw where the software reads data past the intended end of a buffer. Specifically, it involves an "Out-of-Bounds Read" weakness. When processing a message from a storage device, the kernel fails to verify if enough data exists, causing it to read garbage memory instead. This invalid information is then incorrectly treated as the number of active watchers, which can corrupt internal memory structures.

How is this vulnerability triggered?

An attacker must control a storage device that communicates with the client. It is triggered when a client sends a specific request to list watchers and the device replies with a malformed, zero-length structure. Importantly, standard, honest storage devices do not trigger this; the bug requires an intentionally crafted response sent during an active Ceph session to exploit the missing bounds check.

Is this CVE-2026-80557 likely to affect my system?

According to Halo Surface Signal, the risk is currently labeled as unlikely. This is because the vulnerability requires access to the internal storage network where Object Storage Devices (OSDs) reside. Since these communications typically occur over isolated or private management backplanes rather than the public internet, the practical surface area for an attack is generally restricted to the local storage cluster environment.

What steps should I take if I use Ceph?

Start by identifying all servers in your environment running Linux kernel clients that interact with Ceph clusters. Confirm which systems utilize the specific libceph functionality affected by this watcher-list operation. Once mapped, coordinate with your infrastructure or platform teams to plan a kernel update, as applying the official patch that implements the missing bounds check is the necessary remediation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.