CVE-2026-80561 (GCVE-0-2026-80561)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:37 – Updated: 2026-08-27 05:01
VLAI
Title
libceph: fix multiple unsafe decodes in decode_locker()
Summary
In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe decodes in decode_locker() decode_locker() in cls_lock_client.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. ceph_decode_copy() at the locker_id_t name field has no preceding bounds check. With p == end after ceph_start_decoding() accepts struct_len=0, this reads sizeof(ceph_entity_name) = 9 bytes past the validated buffer boundary. 2. *p += sizeof(struct ceph_timespec) after the locker_info_t header is an unchecked pointer advance. A malicious OSD can position p past end, causing all subsequent _safe checks to pass against a bogus boundary. 3. len = ceph_decode_32(p) has no preceding bounds check, and the immediately following *p += len is uncapped. A malicious OSD can send len=0xffffffff, advancing p gigabytes past end and escaping the decode window entirely. Fix all three by replacing bare operations with their safe variants: ceph_decode_copy -> ceph_decode_copy_safe *p += sizeof(...) -> ceph_decode_skip_n ceph_decode_32(p) -> ceph_decode_32_safe *p += len -> ceph_decode_skip_n A new label is added to return -EINVAL on any bounds violation. -EINVAL is appropriate here: the data received from the OSD is structurally malformed, which is an invalid argument to the decode contract regardless of whether the caller or the wire is at fault. Attacker model: a malicious or compromised OSD in a multi-tenant Ceph deployment can trigger this against any kernel client that issues the lock.get_info class method (e.g. during RBD exclusive lock acquisition) without any further privileges beyond OSD session establishment. [ idryomov: use ceph_decode_skip_string() to skip description, trim changelog ]
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d4ed4a530562881cc5225050e42d96034f405aae , < 1ed45c8d96498725eb54f740172f9068d8673906 (git)
Affected: d4ed4a530562881cc5225050e42d96034f405aae , < 6265103e78f0ee7e2518de9cf938b94bee9700a0 (git)
Affected: d4ed4a530562881cc5225050e42d96034f405aae , < 3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070 (git)
Affected: d4ed4a530562881cc5225050e42d96034f405aae , < fa4aa86fff0c56799c2e3f51a88879053285f4a9 (git)
Affected: d4ed4a530562881cc5225050e42d96034f405aae , < dbfd83f722a78446ec18a476ef7a38e52240b50a (git)
Affected: d4ed4a530562881cc5225050e42d96034f405aae , < d1bba38574d095f191557d397d9633f08cd966b1 (git)
Affected: d4ed4a530562881cc5225050e42d96034f405aae , < 51c8d238fe7236de627ab1a1433694552a904136 (git)
Affected: d4ed4a530562881cc5225050e42d96034f405aae , < 437b6551cfcc235eea1d735a874f9d421f555e17 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.9
Unaffected: 0 , < 4.9 (semver)
Unaffected: 5.10.266 , ≤ 5.10.* (semver)
Unaffected: 5.15.217 , ≤ 5.15.* (semver)
Unaffected: 6.1.184 , ≤ 6.1.* (semver)
Unaffected: 6.6.153 , ≤ 6.6.* (semver)
Unaffected: 6.12.105 , ≤ 6.12.* (semver)
Unaffected: 6.18.46 , ≤ 6.18.* (semver)
Unaffected: 7.1.10 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ceph/cls_lock_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1ed45c8d96498725eb54f740172f9068d8673906",
              "status": "affected",
              "version": "d4ed4a530562881cc5225050e42d96034f405aae",
              "versionType": "git"
            },
            {
              "lessThan": "6265103e78f0ee7e2518de9cf938b94bee9700a0",
              "status": "affected",
              "version": "d4ed4a530562881cc5225050e42d96034f405aae",
              "versionType": "git"
            },
            {
              "lessThan": "3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070",
              "status": "affected",
              "version": "d4ed4a530562881cc5225050e42d96034f405aae",
              "versionType": "git"
            },
            {
              "lessThan": "fa4aa86fff0c56799c2e3f51a88879053285f4a9",
              "status": "affected",
              "version": "d4ed4a530562881cc5225050e42d96034f405aae",
              "versionType": "git"
            },
            {
              "lessThan": "dbfd83f722a78446ec18a476ef7a38e52240b50a",
              "status": "affected",
              "version": "d4ed4a530562881cc5225050e42d96034f405aae",
              "versionType": "git"
            },
            {
              "lessThan": "d1bba38574d095f191557d397d9633f08cd966b1",
              "status": "affected",
              "version": "d4ed4a530562881cc5225050e42d96034f405aae",
              "versionType": "git"
            },
            {
              "lessThan": "51c8d238fe7236de627ab1a1433694552a904136",
              "status": "affected",
              "version": "d4ed4a530562881cc5225050e42d96034f405aae",
              "versionType": "git"
            },
            {
              "lessThan": "437b6551cfcc235eea1d735a874f9d421f555e17",
              "status": "affected",
              "version": "d4ed4a530562881cc5225050e42d96034f405aae",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ceph/cls_lock_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix multiple unsafe decodes in decode_locker()\n\ndecode_locker() in cls_lock_client.c contains three unsafe decode\noperations that allow a malicious or compromised OSD to trigger\nslab-out-of-bounds reads:\n\n1. ceph_decode_copy() at the locker_id_t name field has no preceding\n   bounds check. With p == end after ceph_start_decoding() accepts\n   struct_len=0, this reads sizeof(ceph_entity_name) = 9 bytes past\n   the validated buffer boundary.\n\n2. *p += sizeof(struct ceph_timespec) after the locker_info_t header\n   is an unchecked pointer advance. A malicious OSD can position p\n   past end, causing all subsequent _safe checks to pass against a\n   bogus boundary.\n\n3. len = ceph_decode_32(p) has no preceding bounds check, and the\n   immediately following *p += len is uncapped. A malicious OSD can\n   send len=0xffffffff, advancing p gigabytes past end and escaping\n   the decode window entirely.\n\nFix all three by replacing bare operations with their safe variants:\n  ceph_decode_copy   -\u003e ceph_decode_copy_safe\n  *p += sizeof(...)  -\u003e ceph_decode_skip_n\n  ceph_decode_32(p)  -\u003e ceph_decode_32_safe\n  *p += len          -\u003e ceph_decode_skip_n\n\nA new label is added to return -EINVAL on any bounds violation.\n-EINVAL is appropriate here: the data received from the OSD\nis structurally malformed, which is an invalid argument to the decode\ncontract regardless of whether the caller or the wire is at fault.\n\nAttacker model: a malicious or compromised OSD in a multi-tenant Ceph\ndeployment can trigger this against any kernel client that issues the\nlock.get_info class method (e.g. during RBD exclusive lock acquisition)\nwithout any further privileges beyond OSD session establishment.\n\n[ idryomov: use ceph_decode_skip_string() to skip description, trim\n  changelog ]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is reached when libceph decodes a crafted MOSDOpReply for the lock.get_info class method received over the Ceph messenger TCP session from a compromised or malicious OSD; no local syscall or ioctl is required on the victim.\nAC:L - A malicious OSD fully controls the reply and can set struct_len=0, advance the decode pointer past field boundaries, or send len=0xffffffff to deterministically trigger all three unsafe decodes in decode_locker() without races or special memory layout.\nPR:N - The attacker acts as the remote Ceph OSD peer and needs no account or privileges on the victim Linux host; any kernel RBD client connected to a multi-tenant or attacker-controlled cluster is exposed during automatic exclusive-lock operations.\nUI:N - Once an RBD image is mapped, ceph_cls_lock_info() is invoked automatically during exclusive-lock acquisition and object-map lock recovery; no further victim user or administrator action is required at exploit time.\nS:U - The slab out-of-bounds reads and any resulting kernel memory corruption occur entirely within the victim host kernel running the Ceph client, without crossing VM, container, or IOMMU security boundaries.\nC:H - Unsafe ceph_decode_copy, unchecked pointer advances, and uncapped *p+=len in decode_locker() perform slab out-of-bounds reads; leaked bytes populate ceph_entity_name and influence subsequent ceph_extract_encoded_string() allocation and locker field parsing.\nI:H - Attacker-controlled malformed replies misposition decode pointers so out-of-bounds values and lengths feed heap allocations and locker structure fields in kernel lock-handling paths, providing memory-corruption primitives beyond simple information disclosure.\nA:H - Slab out-of-bounds reads can trigger KASAN faults or kernel oops on instrumented builds, and uncapped pointer advances escaping the decode window can destabilize the RBD lock worker and cause severe availability loss on storage client hosts."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T05:01:49.904Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1ed45c8d96498725eb54f740172f9068d8673906"
        },
        {
          "url": "https://git.kernel.org/stable/c/6265103e78f0ee7e2518de9cf938b94bee9700a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa4aa86fff0c56799c2e3f51a88879053285f4a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/dbfd83f722a78446ec18a476ef7a38e52240b50a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1bba38574d095f191557d397d9633f08cd966b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/51c8d238fe7236de627ab1a1433694552a904136"
        },
        {
          "url": "https://git.kernel.org/stable/c/437b6551cfcc235eea1d735a874f9d421f555e17"
        }
      ],
      "title": "libceph: fix multiple unsafe decodes in decode_locker()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80561",
    "datePublished": "2026-08-26T14:37:26.572Z",
    "dateReserved": "2026-08-26T14:34:25.767Z",
    "dateUpdated": "2026-08-27T05:01:49.904Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80561",
      "date": "2026-09-01",
      "epss": "0.00521",
      "percentile": "0.42175"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80561\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-26T15:17:11.007\",\"lastModified\":\"2026-08-27T06:17:41.057\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nlibceph: fix multiple unsafe decodes in decode_locker()\\n\\ndecode_locker() in cls_lock_client.c contains three unsafe decode\\noperations that allow a malicious or compromised OSD to trigger\\nslab-out-of-bounds reads:\\n\\n1. ceph_decode_copy() at the locker_id_t name field has no preceding\\n   bounds check. With p == end after ceph_start_decoding() accepts\\n   struct_len=0, this reads sizeof(ceph_entity_name) = 9 bytes past\\n   the validated buffer boundary.\\n\\n2. *p += sizeof(struct ceph_timespec) after the locker_info_t header\\n   is an unchecked pointer advance. A malicious OSD can position p\\n   past end, causing all subsequent _safe checks to pass against a\\n   bogus boundary.\\n\\n3. len = ceph_decode_32(p) has no preceding bounds check, and the\\n   immediately following *p += len is uncapped. A malicious OSD can\\n   send len=0xffffffff, advancing p gigabytes past end and escaping\\n   the decode window entirely.\\n\\nFix all three by replacing bare operations with their safe variants:\\n  ceph_decode_copy   -\u003e ceph_decode_copy_safe\\n  *p += sizeof(...)  -\u003e ceph_decode_skip_n\\n  ceph_decode_32(p)  -\u003e ceph_decode_32_safe\\n  *p += len          -\u003e ceph_decode_skip_n\\n\\nA new label is added to return -EINVAL on any bounds violation.\\n-EINVAL is appropriate here: the data received from the OSD\\nis structurally malformed, which is an invalid argument to the decode\\ncontract regardless of whether the caller or the wire is at fault.\\n\\nAttacker model: a malicious or compromised OSD in a multi-tenant Ceph\\ndeployment can trigger this against any kernel client that issues the\\nlock.get_info class method (e.g. during RBD exclusive lock acquisition)\\nwithout any further privileges beyond OSD session establishment.\\n\\n[ idryomov: use ceph_decode_skip_string() to skip description, trim\\n  changelog ]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ceph/cls_lock_client.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d4ed4a530562881cc5225050e42d96034f405aae\",\"lessThan\":\"1ed45c8d96498725eb54f740172f9068d8673906\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d4ed4a530562881cc5225050e42d96034f405aae\",\"lessThan\":\"6265103e78f0ee7e2518de9cf938b94bee9700a0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d4ed4a530562881cc5225050e42d96034f405aae\",\"lessThan\":\"3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d4ed4a530562881cc5225050e42d96034f405aae\",\"lessThan\":\"fa4aa86fff0c56799c2e3f51a88879053285f4a9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d4ed4a530562881cc5225050e42d96034f405aae\",\"lessThan\":\"dbfd83f722a78446ec18a476ef7a38e52240b50a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d4ed4a530562881cc5225050e42d96034f405aae\",\"lessThan\":\"d1bba38574d095f191557d397d9633f08cd966b1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d4ed4a530562881cc5225050e42d96034f405aae\",\"lessThan\":\"51c8d238fe7236de627ab1a1433694552a904136\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d4ed4a530562881cc5225050e42d96034f405aae\",\"lessThan\":\"437b6551cfcc235eea1d735a874f9d421f555e17\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ceph/cls_lock_client.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.266\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.217\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.184\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.153\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.105\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.46\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.10\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1ed45c8d96498725eb54f740172f9068d8673906\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/437b6551cfcc235eea1d735a874f9d421f555e17\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/51c8d238fe7236de627ab1a1433694552a904136\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6265103e78f0ee7e2518de9cf938b94bee9700a0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d1bba38574d095f191557d397d9633f08cd966b1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dbfd83f722a78446ec18a476ef7a38e52240b50a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fa4aa86fff0c56799c2e3f51a88879053285f4a9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-27T15:29:31+00:00",
      "cve": "CVE-2026-80561",
      "id": "CVE-2026-80561",
      "initial_release_date": "2026-08-26T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: libceph: fix multiple unsafe decodes in decode_locker()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80561.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.