CVE-2026-80561

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80561", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.767Z", "datePublished": "2026-08-26T14:37:26.572Z", "dateUpdated": "2026-10-16T19:26:27.238Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-27T05:01:49.904Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix multiple unsafe decodes in decode_locker()\n\ndecode_locker() in cls_lock_client.c contains three unsafe decode\noperations that allow a malicious or compromised OSD to trigger\nslab-out-of-bounds reads:\n\n1. ceph_decode_copy() at the locker_id_t name field has no preceding\n bounds check. With p == end after ceph_start_decoding() accepts\n struct_len=0, this reads sizeof(ceph_entity_name) = 9 bytes past\n the validated buffer boundary.\n\n2. *p += sizeof(struct ceph_timespec) after the locker_info_t header\n is an unchecked pointer advance. A malicious OSD can position p\n past end, causing all subsequent _safe checks to pass against a\n bogus boundary.\n\n3. len = ceph_decode_32(p) has no preceding bounds check, and the\n immediately following *p += len is uncapped. A malicious OSD can\n send len=0xffffffff, advancing p gigabytes past end and escaping\n the decode window entirely.\n\nFix all three by replacing bare operations with their safe variants:\n ceph_decode_copy -> ceph_decode_copy_safe\n *p += sizeof(...) -> ceph_decode_skip_n\n ceph_decode_32(p) -> ceph_decode_32_safe\n *p += len -> ceph_decode_skip_n\n\nA new label is added to return -EINVAL on any bounds violation.\n-EINVAL is appropriate here: the data received from the OSD\nis structurally malformed, which is an invalid argument to the decode\ncontract regardless of whether the caller or the wire is at fault.\n\nAttacker model: a malicious or compromised OSD in a multi-tenant Ceph\ndeployment can trigger this against any kernel client that issues the\nlock.get_info class method (e.g. during RBD exclusive lock acquisition)\nwithout any further privileges beyond OSD session establishment.\n\n[ idryomov: use ceph_decode_skip_string() to skip description, trim\n changelog ]"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The flaw is reached when libceph decodes a crafted MOSDOpReply for the lock.get_info class method received over the Ceph messenger TCP session from a compromised or malicious OSD; no local syscall or ioctl is required on the victim.\nAC:L - A malicious OSD fully controls the reply and can set struct_len=0, advance the decode pointer past field boundaries, or send len=0xffffffff to deterministically trigger all three unsafe decodes in decode_locker() without races or special memory layout.\nPR:N - The attacker acts as the remote Ceph OSD peer and needs no account or privileges on the victim Linux host; any kernel RBD client connected to a multi-tenant or attacker-controlled cluster is exposed during automatic exclusive-lock operations.\nUI:N - Once an RBD image is mapped, ceph_cls_lock_info() is invoked automatically during exclusive-lock acquisition and object-map lock recovery; no further victim user or administrator action is required at exploit time.\nS:U - The slab out-of-bounds reads and any resulting kernel memory corruption occur entirely within the victim host kernel running the Ceph client, without crossing VM, container, or IOMMU security boundaries.\nC:H - Unsafe ceph_decode_copy, unchecked pointer advances, and uncapped *p+=len in decode_locker() perform slab out-of-bounds reads; leaked bytes populate ceph_entity_name and influence subsequent ceph_extract_encoded_string() allocation and locker field parsing.\nI:H - Attacker-controlled malformed replies misposition decode pointers so out-of-bounds values and lengths feed heap allocations and locker structure fields in kernel lock-handling paths, providing memory-corruption primitives beyond simple information disclosure.\nA:H - Slab out-of-bounds reads can trigger KASAN faults or kernel oops on instrumented builds, and uncapped pointer advances escaping the decode window can destabilize the RBD lock worker and cause severe availability loss on storage client hosts."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ceph/cls_lock_client.c"], "versions": [{"version": "d4ed4a530562881cc5225050e42d96034f405aae", "lessThan": "1ed45c8d96498725eb54f740172f9068d8673906", "status": "affected", "versionType": "git"}, {"version": "d4ed4a530562881cc5225050e42d96034f405aae", "lessThan": "6265103e78f0ee7e2518de9cf938b94bee9700a0", "status": "affected", "versionType": "git"}, {"version": "d4ed4a530562881cc5225050e42d96034f405aae", "lessThan": "3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070", "status": "affected", "versionType": "git"}, {"version": "d4ed4a530562881cc5225050e42d96034f405aae", "lessThan": "fa4aa86fff0c56799c2e3f51a88879053285f4a9", "status": "affected", "versionType": "git"}, {"version": "d4ed4a530562881cc5225050e42d96034f405aae", "lessThan": "dbfd83f722a78446ec18a476ef7a38e52240b50a", "status": "affected", "versionType": "git"}, {"version": "d4ed4a530562881cc5225050e42d96034f405aae", "lessThan": "d1bba38574d095f191557d397d9633f08cd966b1", "status": "affected", "versionType": "git"}, {"version": "d4ed4a530562881cc5225050e42d96034f405aae", "lessThan": "51c8d238fe7236de627ab1a1433694552a904136", "status": "affected", "versionType": "git"}, {"version": "d4ed4a530562881cc5225050e42d96034f405aae", "lessThan": "437b6551cfcc235eea1d735a874f9d421f555e17", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ceph/cls_lock_client.c"], "versions": [{"version": "4.9", "status": "affected"}, {"version": "0", "lessThan": "4.9", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.266", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.217", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.184", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.153", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.105", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.46", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.10", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.10.266"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.15.217"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.1.184"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.6.153"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.12.105"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.18.46"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "7.1.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1ed45c8d96498725eb54f740172f9068d8673906"}, {"url": "https://git.kernel.org/stable/c/6265103e78f0ee7e2518de9cf938b94bee9700a0"}, {"url": "https://git.kernel.org/stable/c/3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070"}, {"url": "https://git.kernel.org/stable/c/fa4aa86fff0c56799c2e3f51a88879053285f4a9"}, {"url": "https://git.kernel.org/stable/c/dbfd83f722a78446ec18a476ef7a38e52240b50a"}, {"url": "https://git.kernel.org/stable/c/d1bba38574d095f191557d397d9633f08cd966b1"}, {"url": "https://git.kernel.org/stable/c/51c8d238fe7236de627ab1a1433694552a904136"}, {"url": "https://git.kernel.org/stable/c/437b6551cfcc235eea1d735a874f9d421f555e17"}], "title": "libceph: fix multiple unsafe decodes in decode_locker()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-80561", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:17:30.394724Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:26:27.238Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-80561", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:17:30.394724Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:17:31.299Z"}}], "cna": {"title": "libceph: fix multiple unsafe decodes in decode_locker()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The flaw is reached when libceph decodes a crafted MOSDOpReply for the lock.get_info class method received over the Ceph messenger TCP session from a compromised or malicious OSD; no local syscall or ioctl is required on the victim.\nAC:L - A malicious OSD fully controls the reply and can set struct_len=0, advance the decode pointer past field boundaries, or send len=0xffffffff to deterministically trigger all three unsafe decodes in decode_locker() without races or special memory layout.\nPR:N - The attacker acts as the remote Ceph OSD peer and needs no account or privileges on the victim Linux host; any kernel RBD client connected to a multi-tenant or attacker-controlled cluster is exposed during automatic exclusive-lock operations.\nUI:N - Once an RBD image is mapped, ceph_cls_lock_info() is invoked automatically during exclusive-lock acquisition and object-map lock recovery; no further victim user or administrator action is required at exploit time.\nS:U - The slab out-of-bounds reads and any resulting kernel memory corruption occur entirely within the victim host kernel running the Ceph client, without crossing VM, container, or IOMMU security boundaries.\nC:H - Unsafe ceph_decode_copy, unchecked pointer advances, and uncapped *p+=len in decode_locker() perform slab out-of-bounds reads; leaked bytes populate ceph_entity_name and influence subsequent ceph_extract_encoded_string() allocation and locker field parsing.\nI:H - Attacker-controlled malformed replies misposition decode pointers so out-of-bounds values and lengths feed heap allocations and locker structure fields in kernel lock-handling paths, providing memory-corruption primitives beyond simple information disclosure.\nA:H - Slab out-of-bounds reads can trigger KASAN faults or kernel oops on instrumented builds, and uncapped pointer advances escaping the decode window can destabilize the RBD lock worker and cause severe availability loss on storage client hosts."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "d4ed4a530562881cc5225050e42d96034f405aae", "lessThan": "1ed45c8d96498725eb54f740172f9068d8673906", "versionType": "git"}, {"status": "affected", "version": "d4ed4a530562881cc5225050e42d96034f405aae", "lessThan": "6265103e78f0ee7e2518de9cf938b94bee9700a0", "versionType": "git"}, {"status": "affected", "version": "d4ed4a530562881cc5225050e42d96034f405aae", "lessThan": "3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070", "versionType": "git"}, {"status": "affected", "version": "d4ed4a530562881cc5225050e42d96034f405aae", "lessThan": "fa4aa86fff0c56799c2e3f51a88879053285f4a9", "versionType": "git"}, {"status": "affected", "version": "d4ed4a530562881cc5225050e42d96034f405aae", "lessThan": "dbfd83f722a78446ec18a476ef7a38e52240b50a", "versionType": "git"}, {"status": "affected", "version": "d4ed4a530562881cc5225050e42d96034f405aae", "lessThan": "d1bba38574d095f191557d397d9633f08cd966b1", "versionType": "git"}, {"status": "affected", "version": "d4ed4a530562881cc5225050e42d96034f405aae", "lessThan": "51c8d238fe7236de627ab1a1433694552a904136", "versionType": "git"}, {"status": "affected", "version": "d4ed4a530562881cc5225050e42d96034f405aae", "lessThan": "437b6551cfcc235eea1d735a874f9d421f555e17", "versionType": "git"}], "programFiles": ["net/ceph/cls_lock_client.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.9"}, {"status": "unaffected", "version": "0", "lessThan": "4.9", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.266", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.217", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.184", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.153", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.105", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.46", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.10", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/ceph/cls_lock_client.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/1ed45c8d96498725eb54f740172f9068d8673906"}, {"url": "https://git.kernel.org/stable/c/6265103e78f0ee7e2518de9cf938b94bee9700a0"}, {"url": "https://git.kernel.org/stable/c/3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070"}, {"url": "https://git.kernel.org/stable/c/fa4aa86fff0c56799c2e3f51a88879053285f4a9"}, {"url": "https://git.kernel.org/stable/c/dbfd83f722a78446ec18a476ef7a38e52240b50a"}, {"url": "https://git.kernel.org/stable/c/d1bba38574d095f191557d397d9633f08cd966b1"}, {"url": "https://git.kernel.org/stable/c/51c8d238fe7236de627ab1a1433694552a904136"}, {"url": "https://git.kernel.org/stable/c/437b6551cfcc235eea1d735a874f9d421f555e17"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix multiple unsafe decodes in decode_locker()\n\ndecode_locker() in cls_lock_client.c contains three unsafe decode\noperations that allow a malicious or compromised OSD to trigger\nslab-out-of-bounds reads:\n\n1. ceph_decode_copy() at the locker_id_t name field has no preceding\n bounds check. With p == end after ceph_start_decoding() accepts\n struct_len=0, this reads sizeof(ceph_entity_name) = 9 bytes past\n the validated buffer boundary.\n\n2. *p += sizeof(struct ceph_timespec) after the locker_info_t header\n is an unchecked pointer advance. A malicious OSD can position p\n past end, causing all subsequent _safe checks to pass against a\n bogus boundary.\n\n3. len = ceph_decode_32(p) has no preceding bounds check, and the\n immediately following *p += len is uncapped. A malicious OSD can\n send len=0xffffffff, advancing p gigabytes past end and escaping\n the decode window entirely.\n\nFix all three by replacing bare operations with their safe variants:\n ceph_decode_copy -> ceph_decode_copy_safe\n *p += sizeof(...) -> ceph_decode_skip_n\n ceph_decode_32(p) -> ceph_decode_32_safe\n *p += len -> ceph_decode_skip_n\n\nA new label is added to return -EINVAL on any bounds violation.\n-EINVAL is appropriate here: the data received from the OSD\nis structurally malformed, which is an invalid argument to the decode\ncontract regardless of whether the caller or the wire is at fault.\n\nAttacker model: a malicious or compromised OSD in a multi-tenant Ceph\ndeployment can trigger this against any kernel client that issues the\nlock.get_info class method (e.g. during RBD exclusive lock acquisition)\nwithout any further privileges beyond OSD session establishment.\n\n[ idryomov: use ceph_decode_skip_string() to skip description, trim\n changelog ]"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.266", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.217", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.184", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.153", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.105", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.46", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.10", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "4.9"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-27T05:01:49.904Z"}}}, "cveMetadata": {"cveId": "CVE-2026-80561", "state": "PUBLISHED", "dateUpdated": "2026-10-16T19:26:27.238Z", "dateReserved": "2026-08-26T14:34:25.767Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-26T14:37:26.572Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ceph/cls_lock_client.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1ed45c8d96498725eb54f740172f9068d8673906", "status": "affected", "version": "d4ed4a530562881cc5225050e42d96034f405aae", "versionType": "git"}, {"lessThan": "6265103e78f0ee7e2518de9cf938b94bee9700a0", "status": "affected", "version": "d4ed4a530562881cc5225050e42d96034f405aae", "versionType": "git"}, {"lessThan": "3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070", "status": "affected", "version": "d4ed4a530562881cc5225050e42d96034f405aae", "versionType": "git"}, {"lessThan": "fa4aa86fff0c56799c2e3f51a88879053285f4a9", "status": "affected", "version": "d4ed4a530562881cc5225050e42d96034f405aae", "versionType": "git"}, {"lessThan": "dbfd83f722a78446ec18a476ef7a38e52240b50a", "status": "affected", "version": "d4ed4a530562881cc5225050e42d96034f405aae", "versionType": "git"}, {"lessThan": "d1bba38574d095f191557d397d9633f08cd966b1", "status": "affected", "version": "d4ed4a530562881cc5225050e42d96034f405aae", "versionType": "git"}, {"lessThan": "51c8d238fe7236de627ab1a1433694552a904136", "status": "affected", "version": "d4ed4a530562881cc5225050e42d96034f405aae", "versionType": "git"}, {"lessThan": "437b6551cfcc235eea1d735a874f9d421f555e17", "status": "affected", "version": "d4ed4a530562881cc5225050e42d96034f405aae", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ceph/cls_lock_client.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.9"}, {"lessThan": "4.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.266", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.217", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.184", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.153", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.105", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.46", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix multiple unsafe decodes in decode_locker()\n\ndecode_locker() in cls_lock_client.c contains three unsafe decode\noperations that allow a malicious or compromised OSD to trigger\nslab-out-of-bounds reads:\n\n1. ceph_decode_copy() at the locker_id_t name field has no preceding\n bounds check. With p == end after ceph_start_decoding() accepts\n struct_len=0, this reads sizeof(ceph_entity_name) = 9 bytes past\n the validated buffer boundary.\n\n2. *p += sizeof(struct ceph_timespec) after the locker_info_t header\n is an unchecked pointer advance. A malicious OSD can position p\n past end, causing all subsequent _safe checks to pass against a\n bogus boundary.\n\n3. len = ceph_decode_32(p) has no preceding bounds check, and the\n immediately following *p += len is uncapped. A malicious OSD can\n send len=0xffffffff, advancing p gigabytes past end and escaping\n the decode window entirely.\n\nFix all three by replacing bare operations with their safe variants:\n ceph_decode_copy -> ceph_decode_copy_safe\n *p += sizeof(...) -> ceph_decode_skip_n\n ceph_decode_32(p) -> ceph_decode_32_safe\n *p += len -> ceph_decode_skip_n\n\nA new label is added to return -EINVAL on any bounds violation.\n-EINVAL is appropriate here: the data received from the OSD\nis structurally malformed, which is an invalid argument to the decode\ncontract regardless of whether the caller or the wire is at fault.\n\nAttacker model: a malicious or compromised OSD in a multi-tenant Ceph\ndeployment can trigger this against any kernel client that issues the\nlock.get_info class method (e.g. during RBD exclusive lock acquisition)\nwithout any further privileges beyond OSD session establishment.\n\n[ idryomov: use ceph_decode_skip_string() to skip description, trim\n changelog ]"}], "id": "CVE-2026-80561", "lastModified": "2026-10-16T20:18:00.360", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-80561", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:17:30.394724Z", "version": "2.0.3"}}]}, "published": "2026-08-26T15:17:11.007", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1ed45c8d96498725eb54f740172f9068d8673906"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/437b6551cfcc235eea1d735a874f9d421f555e17"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/51c8d238fe7236de627ab1a1433694552a904136"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6265103e78f0ee7e2518de9cf938b94bee9700a0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d1bba38574d095f191557d397d9633f08cd966b1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dbfd83f722a78446ec18a476ef7a38e52240b50a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fa4aa86fff0c56799c2e3f51a88879053285f4a9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: libceph: fix multiple unsafe decodes in decode_locker()", "id": "2524511", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524511"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nlibceph: fix multiple unsafe decodes in decode_locker()\ndecode_locker() in cls_lock_client.c contains three unsafe decode\noperations that allow a malicious or compromised OSD to trigger\nslab-out-of-bounds reads:\n1. ceph_decode_copy() at the locker_id_t name field has no preceding\nbounds check. With p == end after ceph_start_decoding() accepts\nstruct_len=0, this reads sizeof(ceph_entity_name) = 9 bytes past\nthe validated buffer boundary.\n2. *p += sizeof(struct ceph_timespec) after the locker_info_t header\nis an unchecked pointer advance. A malicious OSD can position p\npast end, causing all subsequent _safe checks to pass against a\nbogus boundary.\n3. len = ceph_decode_32(p) has no preceding bounds check, and the\nimmediately following *p += len is uncapped. A malicious OSD can\nsend len=0xffffffff, advancing p gigabytes past end and escaping\nthe decode window entirely.\nFix all three by replacing bare operations with their safe variants:\nceph_decode_copy -> ceph_decode_copy_safe\n*p += sizeof(...) -> ceph_decode_skip_n\nceph_decode_32(p) -> ceph_decode_32_safe\n*p += len -> ceph_decode_skip_n\nA new label is added to return -EINVAL on any bounds violation.\n-EINVAL is appropriate here: the data received from the OSD\nis structurally malformed, which is an invalid argument to the decode\ncontract regardless of whether the caller or the wire is at fault.\nAttacker model: a malicious or compromised OSD in a multi-tenant Ceph\ndeployment can trigger this against any kernel client that issues the\nlock.get_info class method (e.g. during RBD exclusive lock acquisition)\nwithout any further privileges beyond OSD session establishment.\n[ idryomov: use ceph_decode_skip_string() to skip description, trim\nchangelog ]", "A flaw was found in the Linux kernel's `libceph` component. A malicious or compromised Object Storage Device (OSD) can exploit multiple unsafe decode operations within the `decode_locker()` function. This can lead to slab-out-of-bounds reads, potentially allowing an attacker to disclose sensitive information or cause a denial of service."], "name": "CVE-2026-80561", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80561\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80561\nhttps://lore.kernel.org/linux-cve-announce/2026082610-CVE-2026-80561-57d4@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d4ed4a530562881cc5225050e42d96034f405aae,1ed45c8d96498725eb54f740172f9068d8673906)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d4ed4a530562881cc5225050e42d96034f405aae,6265103e78f0ee7e2518de9cf938b94bee9700a0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d4ed4a530562881cc5225050e42d96034f405aae,3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d4ed4a530562881cc5225050e42d96034f405aae,fa4aa86fff0c56799c2e3f51a88879053285f4a9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d4ed4a530562881cc5225050e42d96034f405aae,dbfd83f722a78446ec18a476ef7a38e52240b50a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d4ed4a530562881cc5225050e42d96034f405aae,d1bba38574d095f191557d397d9633f08cd966b1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d4ed4a530562881cc5225050e42d96034f405aae,51c8d238fe7236de627ab1a1433694552a904136)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d4ed4a530562881cc5225050e42d96034f405aae,437b6551cfcc235eea1d735a874f9d421f555e17)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.9"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.266,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.217,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.184,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.153,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.105,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.46,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.10,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-26T17:00:04.695069+00:00", "updated": "2026-08-27T08:30:07.738701+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-125"]}