CVE-2026-80561

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

libceph: fix multiple unsafe decodes in decode_locker()

decode_locker() in cls_lock_client.c contains three unsafe decode

operations that allow a malicious or compromised OSD to trigger

slab-out-of-bounds reads:

1. ceph_decode_copy() at the locker_id_t name field has no preceding

bounds check. With p == end after ceph_start_decoding() accepts

struct_len=0, this reads sizeof(ceph_entity_name) = 9 bytes past

the validated buffer boundary.

2. *p += sizeof(struct ceph_timespec) after the locker_info_t header

is an unchecked pointer advance. A malicious OSD can position p

past end, causing all subsequent _safe checks to pass against a

bogus boundary.

3. len = ceph_decode_32(p) has no preceding bounds check, and the

immediately following *p += len is uncapped. A malicious OSD can

send len=0xffffffff, advancing p gigabytes past end and escaping

the decode window entirely.

Fix all three by repl

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References