libceph: fix multiple unsafe decodes in decode_locker()
In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe decodes in decode_locker() decode_locker() in cls_lock_client.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. ceph_decode_copy() at the locker_id_t name field has no preceding bounds check. With p == end after ceph_start_decoding() accepts struct_len=0, this reads sizeof(ceph_entity_name) = 9 bytes past the validated buffer boundary. 2. *p += sizeof(struct ceph_timespec) after the locker_info_t header is an unchecked pointer advance. A malicious OSD can position p past end, causing all subsequent _safe checks to pass against a bogus boundary. 3. len = ceph_decode_32(p) has no preceding bounds check, and the immediately following *p += len is uncapped. A malicious OSD can send len=0xffffffff, advancing p gigabytes past end and escaping the decode window entirely. Fix all three by replacing bare operations with their safe variants: ceph_decode_copy -> ceph_decode_copy_safe *p += sizeof(...) -> ceph_decode_skip_n ceph_decode_32(p) -> ceph_decode_32_safe *p += len -> ceph_decode_skip_n A new label is added to return -EINVAL on any bounds violation. -EINVAL is appropriate here: the data received from the OSD is structurally malformed, which is an invalid argument to the decode contract regardless of whether the caller or the wire is at fault. Attacker model: a malicious or compromised OSD in a multi-tenant Ceph
CVE-2026-80561
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-80561
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "d4ed4a530562881cc5225050e42d96034f405aae",
"lessThan": "1ed45c8d96498725eb54f740172f9068d8673906",
"versionType": "git"
},
{
"status": "affected",
"version": "d4ed4a530562881cc5225050e42d96034f405aae",
"lessThan": "6265103e78f0ee7e2518de9cf938b94bee9700a0",
"versionType": "git"
},
{
"status": "affected",
"version": "d4ed4a530562881cc5225050e42d96034f405aae",
"lessThan": "3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070",
"versionType": "git"
},
{
"status": "affected",
"version": "d4ed4a530562881cc5225050e42d96034f405aae",
"lessThan": "fa4aa86fff0c56799c2e3f51a88879053285f4a9",
"versionType": "git"
},
{
"status": "affected",
"version": "d4ed4a530562881cc5225050e42d96034f405aae",
"lessThan": "dbfd83f722a78446ec18a476ef7a38e52240b50a",
"versionType": "git"
},
{
"status": "affected",
"version": "d4ed4a530562881cc5225050e42d96034f405aae",
"lessThan": "d1bba38574d095f191557d397d9633f08cd966b1",
"versionType": "git"
},
{
"status": "affected",
"version": "d4ed4a530562881cc5225050e42d96034f405aae",
"lessThan": "51c8d238fe7236de627ab1a1433694552a904136",
"versionType": "git"
},
{
"status": "affected",
"version": "d4ed4a530562881cc5225050e42d96034f405aae",
"lessThan": "437b6551cfcc235eea1d735a874f9d421f555e17",
"versionType": "git"
}
],
"programFiles": [
"net/ceph/cls_lock_client.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.9",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/ceph/cls_lock_client.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-80561
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #34326 · Revision 1
- Added to Heist Feed
- Publisher date