CVE-2026-68433

In the Linux kernel, the following vulnerability has been resolved:

libceph: bound get_version reply decode to front len

handlegetversionreply() uses msg->frontalloclen as the decode boundary for MONGETVERSIONREPLY. That is the size of the reused reply buffer, not the number of bytes actually received.

A truncated reply can therefore pass cephdecodeneed() and decode the second u64 from stale tail bytes left in the buffer by an earlier message, causing an uninitialized memory read.

Use msg->front.iov_len as the receive-side decode boundary, matching other libceph reply handlers and limiting decoding to the bytes that were actually read from the wire.