CVE-2026-68082

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

libceph: fix two unsafe bare decodes in decode_lockers()

decode_lockers() in cls_lock_client.c contains two bare decode operations

that allow a malicious or compromised OSD to trigger slab-out-of-bounds

reads:

1. ceph_decode_32(p) at the num_lockers field has no preceding bounds

check. ceph_start_decoding() accepts struct_len=0 as valid -- the

internal ceph_decode_need(p, end, 0, bad) always passes -- so when an

OSD sends struct_len=0, ceph_start_decoding() returns success with

p == end. The immediately following bare ceph_decode_32(p) then reads

4 bytes past the validated buffer boundary. The garbage value is

passed directly to kzalloc_objs() as the locker count.

The sibling function decode_watchers() in osd_client.c already uses

ceph_decode_32_safe() after its own ceph_start_decoding() call.

decode_lockers() was the only site using the bare variant.

2. ceph_decode_8(p) after the decode

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References