CVE-2026-68433: libceph: bound get_version reply decode to front len

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

libceph: bound get_version reply decode to front len

handle_get_version_reply() uses msg->front_alloc_len as the decode
boundary for MON_GET_VERSION_REPLY.  That is the size of the reused
reply buffer, not the number of bytes actually received.

A truncated reply can therefore pass ceph_decode_need() and decode the
second u64 from stale tail bytes left in the buffer by an earlier
message, causing an uninitialized memory read.

Use msg->front.iov_len as the receive-side decode boundary, matching
other libceph reply handlers and limiting decoding to the bytes that
were actually read from the wire.

The Linux kernel CVE team has assigned CVE-2026-68433 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.16 with commit 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 and fixed in 6.6.148 with commit 340e0386aa39da181015bee38f309018c335ce16
	Issue introduced in 3.16 with commit 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 and fixed in 6.12.101 with commit d60de8253c85a02d0e6194b0735e7a562981a04c
	Issue introduced in 3.16 with commit 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 and fixed in 6.18.42 with commit 4e7ebfaa0d14cf50e44041bfde38070d6dbc019f
	Issue introduced in 3.16 with commit 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 and fixed in 7.1.6 with commit 0d934c934ec746d53fc7e4f53239792647bbae63
	Issue introduced in 3.16 with commit 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 and fixed in 7.2-rc5 with commit d3c32939fa0e3ee9b883b9a0fd1972c5c444e3d0

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68433
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ceph/mon_client.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/340e0386aa39da181015bee38f309018c335ce16
	https://git.kernel.org/stable/c/d60de8253c85a02d0e6194b0735e7a562981a04c
	https://git.kernel.org/stable/c/4e7ebfaa0d14cf50e44041bfde38070d6dbc019f
	https://git.kernel.org/stable/c/0d934c934ec746d53fc7e4f53239792647bbae63
	https://git.kernel.org/stable/c/d3c32939fa0e3ee9b883b9a0fd1972c5c444e3d0