CVE-2026-68433

In the Linux kernel, the following vulnerability has been resolved:

libceph: bound get_version reply decode to front len

handle_get_version_reply() uses msg->front_alloc_len as the decode

boundary for MON_GET_VERSION_REPLY. That is the size of the reused

reply buffer, not the number of bytes actually received.

A truncated reply can therefore pass ceph_decode_need() and decode the

second u64 from stale tail bytes left in the buffer by an earlier

message, causing an uninitialized memory read.

Use msg->front.iov_len as the receive-side decode boundary, matching

other libceph reply handlers and limiting decoding to the bytes that

were actually read from the wire.