{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-80561","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-26T14:34:25.767Z","datePublished":"2026-08-26T14:37:26.572Z","dateUpdated":"2026-08-27T05:01:49.904Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-27T05:01:49.904Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix multiple unsafe decodes in decode_locker()\n\ndecode_locker() in cls_lock_client.c contains three unsafe decode\noperations that allow a malicious or compromised OSD to trigger\nslab-out-of-bounds reads:\n\n1. ceph_decode_copy() at the locker_id_t name field has no preceding\n   bounds check. With p == end after ceph_start_decoding() accepts\n   struct_len=0, this reads sizeof(ceph_entity_name) = 9 bytes past\n   the validated buffer boundary.\n\n2. *p += sizeof(struct ceph_timespec) after the locker_info_t header\n   is an unchecked pointer advance. A malicious OSD can position p\n   past end, causing all subsequent _safe checks to pass against a\n   bogus boundary.\n\n3. len = ceph_decode_32(p) has no preceding bounds check, and the\n   immediately following *p += len is uncapped. A malicious OSD can\n   send len=0xffffffff, advancing p gigabytes past end and escaping\n   the decode window entirely.\n\nFix all three by replacing bare operations with their safe variants:\n  ceph_decode_copy   -> ceph_decode_copy_safe\n  *p += sizeof(...)  -> ceph_decode_skip_n\n  ceph_decode_32(p)  -> ceph_decode_32_safe\n  *p += len          -> ceph_decode_skip_n\n\nA new label is added to return -EINVAL on any bounds violation.\n-EINVAL is appropriate here: the data received from the OSD\nis structurally malformed, which is an invalid argument to the decode\ncontract regardless of whether the caller or the wire is at fault.\n\nAttacker model: a malicious or compromised OSD in a multi-tenant Ceph\ndeployment can trigger this against any kernel client that issues the\nlock.get_info class method (e.g. during RBD exclusive lock acquisition)\nwithout any further privileges beyond OSD session establishment.\n\n[ idryomov: use ceph_decode_skip_string() to skip description, trim\n  changelog ]"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The flaw is reached when libceph decodes a crafted MOSDOpReply for the lock.get_info class method received over the Ceph messenger TCP session from a compromised or malicious OSD; no local syscall or ioctl is required on the victim.\nAC:L - A malicious OSD fully controls the reply and can set struct_len=0, advance the decode pointer past field boundaries, or send len=0xffffffff to deterministically trigger all three unsafe decodes in decode_locker() without races or special memory layout.\nPR:N - The attacker acts as the remote Ceph OSD peer and needs no account or privileges on the victim Linux host; any kernel RBD client connected to a multi-tenant or attacker-controlled cluster is exposed during automatic exclusive-lock operations.\nUI:N - Once an RBD image is mapped, ceph_cls_lock_info() is invoked automatically during exclusive-lock acquisition and object-map lock recovery; no further victim user or administrator action is required at exploit time.\nS:U - The slab out-of-bounds reads and any resulting kernel memory corruption occur entirely within the victim host kernel running the Ceph client, without crossing VM, container, or IOMMU security boundaries.\nC:H - Unsafe ceph_decode_copy, unchecked pointer advances, and uncapped *p+=len in decode_locker() perform slab out-of-bounds reads; leaked bytes populate ceph_entity_name and influence subsequent ceph_extract_encoded_string() allocation and locker field parsing.\nI:H - Attacker-controlled malformed replies misposition decode pointers so out-of-bounds values and lengths feed heap allocations and locker structure fields in kernel lock-handling paths, providing memory-corruption primitives beyond simple information disclosure.\nA:H - Slab out-of-bounds reads can trigger KASAN faults or kernel oops on instrumented builds, and uncapped pointer advances escaping the decode window can destabilize the RBD lock worker and cause severe availability loss on storage client hosts."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ceph/cls_lock_client.c"],"versions":[{"version":"d4ed4a530562881cc5225050e42d96034f405aae","lessThan":"1ed45c8d96498725eb54f740172f9068d8673906","status":"affected","versionType":"git"},{"version":"d4ed4a530562881cc5225050e42d96034f405aae","lessThan":"6265103e78f0ee7e2518de9cf938b94bee9700a0","status":"affected","versionType":"git"},{"version":"d4ed4a530562881cc5225050e42d96034f405aae","lessThan":"3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070","status":"affected","versionType":"git"},{"version":"d4ed4a530562881cc5225050e42d96034f405aae","lessThan":"fa4aa86fff0c56799c2e3f51a88879053285f4a9","status":"affected","versionType":"git"},{"version":"d4ed4a530562881cc5225050e42d96034f405aae","lessThan":"dbfd83f722a78446ec18a476ef7a38e52240b50a","status":"affected","versionType":"git"},{"version":"d4ed4a530562881cc5225050e42d96034f405aae","lessThan":"d1bba38574d095f191557d397d9633f08cd966b1","status":"affected","versionType":"git"},{"version":"d4ed4a530562881cc5225050e42d96034f405aae","lessThan":"51c8d238fe7236de627ab1a1433694552a904136","status":"affected","versionType":"git"},{"version":"d4ed4a530562881cc5225050e42d96034f405aae","lessThan":"437b6551cfcc235eea1d735a874f9d421f555e17","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ceph/cls_lock_client.c"],"versions":[{"version":"4.9","status":"affected"},{"version":"0","lessThan":"4.9","status":"unaffected","versionType":"semver"},{"version":"5.10.266","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.217","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.184","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.153","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.105","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.46","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.10","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"5.10.266"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"5.15.217"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"6.1.184"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"6.6.153"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"6.12.105"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"6.18.46"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"7.1.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/1ed45c8d96498725eb54f740172f9068d8673906"},{"url":"https://git.kernel.org/stable/c/6265103e78f0ee7e2518de9cf938b94bee9700a0"},{"url":"https://git.kernel.org/stable/c/3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070"},{"url":"https://git.kernel.org/stable/c/fa4aa86fff0c56799c2e3f51a88879053285f4a9"},{"url":"https://git.kernel.org/stable/c/dbfd83f722a78446ec18a476ef7a38e52240b50a"},{"url":"https://git.kernel.org/stable/c/d1bba38574d095f191557d397d9633f08cd966b1"},{"url":"https://git.kernel.org/stable/c/51c8d238fe7236de627ab1a1433694552a904136"},{"url":"https://git.kernel.org/stable/c/437b6551cfcc235eea1d735a874f9d421f555e17"}],"title":"libceph: fix multiple unsafe decodes in decode_locker()","x_generator":{"engine":"bippy-1.2.0"}}}}