CVE-2026-80561 (GCVE-0-2026-80561)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:37 – Updated: 2026-10-16 19:26
VLAI
Title
libceph: fix multiple unsafe decodes in decode_locker()
Summary
In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe decodes in decode_locker() decode_locker() in cls_lock_client.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. ceph_decode_copy() at the locker_id_t name field has no preceding bounds check. With p == end after ceph_start_decoding() accepts struct_len=0, this reads sizeof(ceph_entity_name) = 9 bytes past the validated buffer boundary. 2. *p += sizeof(struct ceph_timespec) after the locker_info_t header is an unchecked pointer advance. A malicious OSD can position p past end, causing all subsequent _safe checks to pass against a bogus boundary. 3. len = ceph_decode_32(p) has no preceding bounds check, and the immediately following *p += len is uncapped. A malicious OSD can send len=0xffffffff, advancing p gigabytes past end and escaping the decode window entirely. Fix all three by replacing bare operations with their safe variants: ceph_decode_copy -> ceph_decode_copy_safe *p += sizeof(...) -> ceph_decode_skip_n ceph_decode_32(p) -> ceph_decode_32_safe *p += len -> ceph_decode_skip_n A new label is added to return -EINVAL on any bounds violation. -EINVAL is appropriate here: the data received from the OSD is structurally malformed, which is an invalid argument to the decode contract regardless of whether the caller or the wire is at fault. Attacker model: a malicious or compromised OSD in a multi-tenant Ceph deployment can trigger this against any kernel client that issues the lock.get_info class method (e.g. during RBD exclusive lock acquisition) without any further privileges beyond OSD session establishment. [ idryomov: use ceph_decode_skip_string() to skip description, trim changelog ]
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 19:17 UTC
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6666 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d4ed4a530562881cc5225050e42d96034f405aae , < 1ed45c8d96498725eb54f740172f9068d8673906 (git)
Affected: d4ed4a530562881cc5225050e42d96034f405aae , < 6265103e78f0ee7e2518de9cf938b94bee9700a0 (git)
Affected: d4ed4a530562881cc5225050e42d96034f405aae , < 3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070 (git)
Affected: d4ed4a530562881cc5225050e42d96034f405aae , < fa4aa86fff0c56799c2e3f51a88879053285f4a9 (git)
Affected: d4ed4a530562881cc5225050e42d96034f405aae , < dbfd83f722a78446ec18a476ef7a38e52240b50a (git)
Affected: d4ed4a530562881cc5225050e42d96034f405aae , < d1bba38574d095f191557d397d9633f08cd966b1 (git)
Affected: d4ed4a530562881cc5225050e42d96034f405aae , < 51c8d238fe7236de627ab1a1433694552a904136 (git)
Affected: d4ed4a530562881cc5225050e42d96034f405aae , < 437b6551cfcc235eea1d735a874f9d421f555e17 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.9
Unaffected: 0 , < 4.9 (semver)
Unaffected: 5.10.266 , ≤ 5.10.* (semver)
Unaffected: 5.15.217 , ≤ 5.15.* (semver)
Unaffected: 6.1.184 , ≤ 6.1.* (semver)
Unaffected: 6.6.153 , ≤ 6.6.* (semver)
Unaffected: 6.12.105 , ≤ 6.12.* (semver)
Unaffected: 6.18.46 , ≤ 6.18.* (semver)
Unaffected: 7.1.10 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-80561",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:17:30.394724Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:27.238Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ceph/cls_lock_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1ed45c8d96498725eb54f740172f9068d8673906",
              "status": "affected",
              "version": "d4ed4a530562881cc5225050e42d96034f405aae",
              "versionType": "git"
            },
            {
              "lessThan": "6265103e78f0ee7e2518de9cf938b94bee9700a0",
              "status": "affected",
              "version": "d4ed4a530562881cc5225050e42d96034f405aae",
              "versionType": "git"
            },
            {
              "lessThan": "3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070",
              "status": "affected",
              "version": "d4ed4a530562881cc5225050e42d96034f405aae",
              "versionType": "git"
            },
            {
              "lessThan": "fa4aa86fff0c56799c2e3f51a88879053285f4a9",
              "status": "affected",
              "version": "d4ed4a530562881cc5225050e42d96034f405aae",
              "versionType": "git"
            },
            {
              "lessThan": "dbfd83f722a78446ec18a476ef7a38e52240b50a",
              "status": "affected",
              "version": "d4ed4a530562881cc5225050e42d96034f405aae",
              "versionType": "git"
            },
            {
              "lessThan": "d1bba38574d095f191557d397d9633f08cd966b1",
              "status": "affected",
              "version": "d4ed4a530562881cc5225050e42d96034f405aae",
              "versionType": "git"
            },
            {
              "lessThan": "51c8d238fe7236de627ab1a1433694552a904136",
              "status": "affected",
              "version": "d4ed4a530562881cc5225050e42d96034f405aae",
              "versionType": "git"
            },
            {
              "lessThan": "437b6551cfcc235eea1d735a874f9d421f555e17",
              "status": "affected",
              "version": "d4ed4a530562881cc5225050e42d96034f405aae",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ceph/cls_lock_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix multiple unsafe decodes in decode_locker()\n\ndecode_locker() in cls_lock_client.c contains three unsafe decode\noperations that allow a malicious or compromised OSD to trigger\nslab-out-of-bounds reads:\n\n1. ceph_decode_copy() at the locker_id_t name field has no preceding\n   bounds check. With p == end after ceph_start_decoding() accepts\n   struct_len=0, this reads sizeof(ceph_entity_name) = 9 bytes past\n   the validated buffer boundary.\n\n2. *p += sizeof(struct ceph_timespec) after the locker_info_t header\n   is an unchecked pointer advance. A malicious OSD can position p\n   past end, causing all subsequent _safe checks to pass against a\n   bogus boundary.\n\n3. len = ceph_decode_32(p) has no preceding bounds check, and the\n   immediately following *p += len is uncapped. A malicious OSD can\n   send len=0xffffffff, advancing p gigabytes past end and escaping\n   the decode window entirely.\n\nFix all three by replacing bare operations with their safe variants:\n  ceph_decode_copy   -\u003e ceph_decode_copy_safe\n  *p += sizeof(...)  -\u003e ceph_decode_skip_n\n  ceph_decode_32(p)  -\u003e ceph_decode_32_safe\n  *p += len          -\u003e ceph_decode_skip_n\n\nA new label is added to return -EINVAL on any bounds violation.\n-EINVAL is appropriate here: the data received from the OSD\nis structurally malformed, which is an invalid argument to the decode\ncontract regardless of whether the caller or the wire is at fault.\n\nAttacker model: a malicious or compromised OSD in a multi-tenant Ceph\ndeployment can trigger this against any kernel client that issues the\nlock.get_info class method (e.g. during RBD exclusive lock acquisition)\nwithout any further privileges beyond OSD session establishment.\n\n[ idryomov: use ceph_decode_skip_string() to skip description, trim\n  changelog ]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is reached when libceph decodes a crafted MOSDOpReply for the lock.get_info class method received over the Ceph messenger TCP session from a compromised or malicious OSD; no local syscall or ioctl is required on the victim.\nAC:L - A malicious OSD fully controls the reply and can set struct_len=0, advance the decode pointer past field boundaries, or send len=0xffffffff to deterministically trigger all three unsafe decodes in decode_locker() without races or special memory layout.\nPR:N - The attacker acts as the remote Ceph OSD peer and needs no account or privileges on the victim Linux host; any kernel RBD client connected to a multi-tenant or attacker-controlled cluster is exposed during automatic exclusive-lock operations.\nUI:N - Once an RBD image is mapped, ceph_cls_lock_info() is invoked automatically during exclusive-lock acquisition and object-map lock recovery; no further victim user or administrator action is required at exploit time.\nS:U - The slab out-of-bounds reads and any resulting kernel memory corruption occur entirely within the victim host kernel running the Ceph client, without crossing VM, container, or IOMMU security boundaries.\nC:H - Unsafe ceph_decode_copy, unchecked pointer advances, and uncapped *p+=len in decode_locker() perform slab out-of-bounds reads; leaked bytes populate ceph_entity_name and influence subsequent ceph_extract_encoded_string() allocation and locker field parsing.\nI:H - Attacker-controlled malformed replies misposition decode pointers so out-of-bounds values and lengths feed heap allocations and locker structure fields in kernel lock-handling paths, providing memory-corruption primitives beyond simple information disclosure.\nA:H - Slab out-of-bounds reads can trigger KASAN faults or kernel oops on instrumented builds, and uncapped pointer advances escaping the decode window can destabilize the RBD lock worker and cause severe availability loss on storage client hosts."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T05:01:49.904Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1ed45c8d96498725eb54f740172f9068d8673906"
        },
        {
          "url": "https://git.kernel.org/stable/c/6265103e78f0ee7e2518de9cf938b94bee9700a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa4aa86fff0c56799c2e3f51a88879053285f4a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/dbfd83f722a78446ec18a476ef7a38e52240b50a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1bba38574d095f191557d397d9633f08cd966b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/51c8d238fe7236de627ab1a1433694552a904136"
        },
        {
          "url": "https://git.kernel.org/stable/c/437b6551cfcc235eea1d735a874f9d421f555e17"
        }
      ],
      "title": "libceph: fix multiple unsafe decodes in decode_locker()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80561",
    "datePublished": "2026-08-26T14:37:26.572Z",
    "dateReserved": "2026-08-26T14:34:25.767Z",
    "dateUpdated": "2026-10-16T19:26:27.238Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80561",
      "date": "2026-10-16",
      "epss": "0.00514",
      "percentile": "0.42494"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-24T01:21:19.000Z",
      "cve": "CVE-2026-80561",
      "id": "msrc_CVE-2026-80561",
      "initial_release_date": "2026-08-27T01:07:04.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "libceph: fix multiple unsafe decodes in decode_locker()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-80561.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/ceph/cls_lock_client.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "1ed45c8d96498725eb54f740172f9068d8673906",
                    "status": "affected",
                    "version": "d4ed4a530562881cc5225050e42d96034f405aae",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6265103e78f0ee7e2518de9cf938b94bee9700a0",
                    "status": "affected",
                    "version": "d4ed4a530562881cc5225050e42d96034f405aae",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070",
                    "status": "affected",
                    "version": "d4ed4a530562881cc5225050e42d96034f405aae",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fa4aa86fff0c56799c2e3f51a88879053285f4a9",
                    "status": "affected",
                    "version": "d4ed4a530562881cc5225050e42d96034f405aae",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dbfd83f722a78446ec18a476ef7a38e52240b50a",
                    "status": "affected",
                    "version": "d4ed4a530562881cc5225050e42d96034f405aae",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d1bba38574d095f191557d397d9633f08cd966b1",
                    "status": "affected",
                    "version": "d4ed4a530562881cc5225050e42d96034f405aae",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "51c8d238fe7236de627ab1a1433694552a904136",
                    "status": "affected",
                    "version": "d4ed4a530562881cc5225050e42d96034f405aae",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "437b6551cfcc235eea1d735a874f9d421f555e17",
                    "status": "affected",
                    "version": "d4ed4a530562881cc5225050e42d96034f405aae",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/ceph/cls_lock_client.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.9"
                  },
                  {
                    "lessThan": "4.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.266",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.217",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.184",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.153",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.105",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.46",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix multiple unsafe decodes in decode_locker()\n\ndecode_locker() in cls_lock_client.c contains three unsafe decode\noperations that allow a malicious or compromised OSD to trigger\nslab-out-of-bounds reads:\n\n1. ceph_decode_copy() at the locker_id_t name field has no preceding\n   bounds check. With p == end after ceph_start_decoding() accepts\n   struct_len=0, this reads sizeof(ceph_entity_name) = 9 bytes past\n   the validated buffer boundary.\n\n2. *p += sizeof(struct ceph_timespec) after the locker_info_t header\n   is an unchecked pointer advance. A malicious OSD can position p\n   past end, causing all subsequent _safe checks to pass against a\n   bogus boundary.\n\n3. len = ceph_decode_32(p) has no preceding bounds check, and the\n   immediately following *p += len is uncapped. A malicious OSD can\n   send len=0xffffffff, advancing p gigabytes past end and escaping\n   the decode window entirely.\n\nFix all three by replacing bare operations with their safe variants:\n  ceph_decode_copy   -\u003e ceph_decode_copy_safe\n  *p += sizeof(...)  -\u003e ceph_decode_skip_n\n  ceph_decode_32(p)  -\u003e ceph_decode_32_safe\n  *p += len          -\u003e ceph_decode_skip_n\n\nA new label is added to return -EINVAL on any bounds violation.\n-EINVAL is appropriate here: the data received from the OSD\nis structurally malformed, which is an invalid argument to the decode\ncontract regardless of whether the caller or the wire is at fault.\n\nAttacker model: a malicious or compromised OSD in a multi-tenant Ceph\ndeployment can trigger this against any kernel client that issues the\nlock.get_info class method (e.g. during RBD exclusive lock acquisition)\nwithout any further privileges beyond OSD session establishment.\n\n[ idryomov: use ceph_decode_skip_string() to skip description, trim\n  changelog ]"
          }
        ],
        "id": "CVE-2026-80561",
        "lastModified": "2026-10-16T20:18:00.360",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-80561",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:17:30.394724Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-26T15:17:11.007",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1ed45c8d96498725eb54f740172f9068d8673906"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/437b6551cfcc235eea1d735a874f9d421f555e17"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/51c8d238fe7236de627ab1a1433694552a904136"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6265103e78f0ee7e2518de9cf938b94bee9700a0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d1bba38574d095f191557d397d9633f08cd966b1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dbfd83f722a78446ec18a476ef7a38e52240b50a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fa4aa86fff0c56799c2e3f51a88879053285f4a9"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-27T15:29:31+00:00",
      "cve": "CVE-2026-80561",
      "id": "CVE-2026-80561",
      "initial_release_date": "2026-08-26T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: libceph: fix multiple unsafe decodes in decode_locker()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80561.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-80561",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-16T19:17:30.394724Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-16T19:17:31.299Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "net/ceph/cls_lock_client.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "1ed45c8d96498725eb54f740172f9068d8673906",
                  "status": "affected",
                  "version": "d4ed4a530562881cc5225050e42d96034f405aae",
                  "versionType": "git"
                },
                {
                  "lessThan": "6265103e78f0ee7e2518de9cf938b94bee9700a0",
                  "status": "affected",
                  "version": "d4ed4a530562881cc5225050e42d96034f405aae",
                  "versionType": "git"
                },
                {
                  "lessThan": "3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070",
                  "status": "affected",
                  "version": "d4ed4a530562881cc5225050e42d96034f405aae",
                  "versionType": "git"
                },
                {
                  "lessThan": "fa4aa86fff0c56799c2e3f51a88879053285f4a9",
                  "status": "affected",
                  "version": "d4ed4a530562881cc5225050e42d96034f405aae",
                  "versionType": "git"
                },
                {
                  "lessThan": "dbfd83f722a78446ec18a476ef7a38e52240b50a",
                  "status": "affected",
                  "version": "d4ed4a530562881cc5225050e42d96034f405aae",
                  "versionType": "git"
                },
                {
                  "lessThan": "d1bba38574d095f191557d397d9633f08cd966b1",
                  "status": "affected",
                  "version": "d4ed4a530562881cc5225050e42d96034f405aae",
                  "versionType": "git"
                },
                {
                  "lessThan": "51c8d238fe7236de627ab1a1433694552a904136",
                  "status": "affected",
                  "version": "d4ed4a530562881cc5225050e42d96034f405aae",
                  "versionType": "git"
                },
                {
                  "lessThan": "437b6551cfcc235eea1d735a874f9d421f555e17",
                  "status": "affected",
                  "version": "d4ed4a530562881cc5225050e42d96034f405aae",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "net/ceph/cls_lock_client.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.9"
                },
                {
                  "lessThan": "4.9",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.266",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.217",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.184",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.153",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.12.*",
                  "status": "unaffected",
                  "version": "6.12.105",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.18.*",
                  "status": "unaffected",
                  "version": "6.18.46",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.1.*",
                  "status": "unaffected",
                  "version": "7.1.10",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "7.2",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.266",
                      "versionStartIncluding": "4.9",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.217",
                      "versionStartIncluding": "4.9",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.184",
                      "versionStartIncluding": "4.9",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.153",
                      "versionStartIncluding": "4.9",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12.105",
                      "versionStartIncluding": "4.9",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.18.46",
                      "versionStartIncluding": "4.9",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "7.1.10",
                      "versionStartIncluding": "4.9",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "7.2",
                      "versionStartIncluding": "4.9",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix multiple unsafe decodes in decode_locker()\n\ndecode_locker() in cls_lock_client.c contains three unsafe decode\noperations that allow a malicious or compromised OSD to trigger\nslab-out-of-bounds reads:\n\n1. ceph_decode_copy() at the locker_id_t name field has no preceding\n   bounds check. With p == end after ceph_start_decoding() accepts\n   struct_len=0, this reads sizeof(ceph_entity_name) = 9 bytes past\n   the validated buffer boundary.\n\n2. *p += sizeof(struct ceph_timespec) after the locker_info_t header\n   is an unchecked pointer advance. A malicious OSD can position p\n   past end, causing all subsequent _safe checks to pass against a\n   bogus boundary.\n\n3. len = ceph_decode_32(p) has no preceding bounds check, and the\n   immediately following *p += len is uncapped. A malicious OSD can\n   send len=0xffffffff, advancing p gigabytes past end and escaping\n   the decode window entirely.\n\nFix all three by replacing bare operations with their safe variants:\n  ceph_decode_copy   -\u003e ceph_decode_copy_safe\n  *p += sizeof(...)  -\u003e ceph_decode_skip_n\n  ceph_decode_32(p)  -\u003e ceph_decode_32_safe\n  *p += len          -\u003e ceph_decode_skip_n\n\nA new label is added to return -EINVAL on any bounds violation.\n-EINVAL is appropriate here: the data received from the OSD\nis structurally malformed, which is an invalid argument to the decode\ncontract regardless of whether the caller or the wire is at fault.\n\nAttacker model: a malicious or compromised OSD in a multi-tenant Ceph\ndeployment can trigger this against any kernel client that issues the\nlock.get_info class method (e.g. during RBD exclusive lock acquisition)\nwithout any further privileges beyond OSD session establishment.\n\n[ idryomov: use ceph_decode_skip_string() to skip description, trim\n  changelog ]"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:N - The flaw is reached when libceph decodes a crafted MOSDOpReply for the lock.get_info class method received over the Ceph messenger TCP session from a compromised or malicious OSD; no local syscall or ioctl is required on the victim.\nAC:L - A malicious OSD fully controls the reply and can set struct_len=0, advance the decode pointer past field boundaries, or send len=0xffffffff to deterministically trigger all three unsafe decodes in decode_locker() without races or special memory layout.\nPR:N - The attacker acts as the remote Ceph OSD peer and needs no account or privileges on the victim Linux host; any kernel RBD client connected to a multi-tenant or attacker-controlled cluster is exposed during automatic exclusive-lock operations.\nUI:N - Once an RBD image is mapped, ceph_cls_lock_info() is invoked automatically during exclusive-lock acquisition and object-map lock recovery; no further victim user or administrator action is required at exploit time.\nS:U - The slab out-of-bounds reads and any resulting kernel memory corruption occur entirely within the victim host kernel running the Ceph client, without crossing VM, container, or IOMMU security boundaries.\nC:H - Unsafe ceph_decode_copy, unchecked pointer advances, and uncapped *p+=len in decode_locker() perform slab out-of-bounds reads; leaked bytes populate ceph_entity_name and influence subsequent ceph_extract_encoded_string() allocation and locker field parsing.\nI:H - Attacker-controlled malformed replies misposition decode pointers so out-of-bounds values and lengths feed heap allocations and locker structure fields in kernel lock-handling paths, providing memory-corruption primitives beyond simple information disclosure.\nA:H - Slab out-of-bounds reads can trigger KASAN faults or kernel oops on instrumented builds, and uncapped pointer advances escaping the decode window can destabilize the RBD lock worker and cause severe availability loss on storage client hosts."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-27T05:01:49.904Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/1ed45c8d96498725eb54f740172f9068d8673906"
            },
            {
              "url": "https://git.kernel.org/stable/c/6265103e78f0ee7e2518de9cf938b94bee9700a0"
            },
            {
              "url": "https://git.kernel.org/stable/c/3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070"
            },
            {
              "url": "https://git.kernel.org/stable/c/fa4aa86fff0c56799c2e3f51a88879053285f4a9"
            },
            {
              "url": "https://git.kernel.org/stable/c/dbfd83f722a78446ec18a476ef7a38e52240b50a"
            },
            {
              "url": "https://git.kernel.org/stable/c/d1bba38574d095f191557d397d9633f08cd966b1"
            },
            {
              "url": "https://git.kernel.org/stable/c/51c8d238fe7236de627ab1a1433694552a904136"
            },
            {
              "url": "https://git.kernel.org/stable/c/437b6551cfcc235eea1d735a874f9d421f555e17"
            }
          ],
          "title": "libceph: fix multiple unsafe decodes in decode_locker()",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2026-80561",
        "datePublished": "2026-08-26T14:37:26.572Z",
        "dateReserved": "2026-08-26T14:34:25.767Z",
        "dateUpdated": "2026-10-16T19:26:27.238Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.