{"id":"CVE-2026-80561","revision":null,"records":[{"revision":"daadc50b1aae4253a4c4208768a46a84","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-80561","aliases":[],"title":"libceph: fix multiple unsafe decodes in decode_locker()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix multiple unsafe decodes in decode_locker()\n\ndecode_locker() in cls_lock_client.c contains three unsafe decode\noperations that allow a malicious or compromised OSD to trigger\nslab-out-of-bounds reads:\n\n1. ceph_decode_copy() at the locker_id_t name field has no preceding\n bounds check. With p == end after ceph_start_decoding() accepts\n struct_len=0, this reads sizeof(ceph_entity_name) = 9 bytes past\n the validated buffer boundary.\n\n2. *p += sizeof(struct ceph_timespec) after the locker_info_t header\n is an unchecked pointer advance. A malicious OSD can position p\n past end, causing all subsequent _safe checks to pass against a\n bogus boundary.\n\n3. len = ceph_decode_32(p) has no preceding bounds check, and the\n immediately following *p += len is uncapped. A malicious OSD can\n send len=0xffffffff, advancing p gigabytes past end and escaping\n the decode window entirely.\n\nFix all three by replacing bare operations with their safe variants:\n ceph_decode_copy -> ceph_decode_copy_safe\n *p += sizeof(...) -> ceph_decode_skip_n\n ceph_decode_32(p) -> ceph_decode_32_safe\n *p += len -> ceph_decode_skip_n\n\nA new label is added to return -EINVAL on any bounds violation.\n-EINVAL is appropriate here: the data received from the OSD\nis structurally malformed, which is an invalid argument to the decode\ncontract regardless of whether the caller or the wire is at fault.\n\nAttacker model: a malicious or compromised OSD in a multi-tenant Ceph\ndeployment can trigger this against any kernel client that issues the\nlock.get_info class method (e.g. during RBD exclusive lock acquisition)\nwithout any further privileges beyond OSD session establishment.\n\n[ idryomov: use ceph_decode_skip_string() to skip description, trim\n changelog ]","state":0,"publishedAt":"2026-08-26T14:37:26.572+00:00","modifiedAt":"2026-10-16T19:26:27.238+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"net/ceph/cls_lock_client.c\"\n ],\n \"versions\": [\n {\n \"version\": \"d4ed4a530562881cc5225050e42d96034f405aae\",\n \"lessThan\": \"1ed45c8d96498725eb54f740172f9068d8673906\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"d4ed4a530562881cc5225050e42d96034f405aae\",\n \"lessThan\": \"6265103e78f0ee7e2518de9cf938b94bee9700a0\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"d4ed4a530562881cc5225050e42d96034f405aae\",\n \"lessThan\": \"3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"d4ed4a530562881cc5225050e42d96034f405aae\",\n \"lessThan\": \"fa4aa86fff0c56799c2e3f51a88879053285f4a9\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"d4ed4a530562881cc5225050e42d96034f405aae\",\n \"lessThan\": \"dbfd83f722a78446ec18a476ef7a38e52240b50a\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"d4ed4a530562881cc5225050e42d96034f405aae\",\n \"lessThan\": \"d1bba38574d095f191557d397d9633f08cd966b1\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"d4ed4a530562881cc5225050e42d96034f405aae\",\n \"lessThan\": \"51c8d238fe7236de627ab1a1433694552a904136\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"d4ed4a530562881cc5225050e42d96034f405aae\",\n \"lessThan\": \"437b6551cfcc235eea1d735a874f9d421f555e17\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"net/ceph/cls_lock_client.c\"\n ],\n \"versions\": [\n {\n \"version\": \"4.9\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"4.9\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.10.266\",\n \"lessThanOrEqual\": \"5.10.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.217\",\n \"lessThanOrEqual\": \"5.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.184\",\n \"lessThanOrEqual\": \"6.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.153\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.105\",\n \"lessThanOrEqual\": \"6.12.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.18.46\",\n \"lessThanOrEqual\": \"6.18.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.1.10\",\n \"lessThanOrEqual\": \"7.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.2\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/1ed45c8d96498725eb54f740172f9068d8673906","https://git.kernel.org/stable/c/6265103e78f0ee7e2518de9cf938b94bee9700a0","https://git.kernel.org/stable/c/3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070","https://git.kernel.org/stable/c/fa4aa86fff0c56799c2e3f51a88879053285f4a9","https://git.kernel.org/stable/c/dbfd83f722a78446ec18a476ef7a38e52240b50a","https://git.kernel.org/stable/c/d1bba38574d095f191557d397d9633f08cd966b1","https://git.kernel.org/stable/c/51c8d238fe7236de627ab1a1433694552a904136","https://git.kernel.org/stable/c/437b6551cfcc235eea1d735a874f9d421f555e17"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80561","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-80561","identifiers":["CVE-2026-80561"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-09T08:02:26.2193293+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-09T08:02:26.2193293+00:00","lastSuccessAt":"2026-11-09T08:02:26.3903284+00:00","error":null,"lastVerifiedAt":"2026-11-09T08:02:26.3903314+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-24e6fde7b744113daefb8f6135035fb8a5c69c9617c9c0d40574a0376532ffd3-bac7baae6881807b2b4a9dce5cf5dd63af98be3e5c79f031b11fd288ebb8cee0","complete":true,"records":421301,"lastAttemptAt":"2026-11-09T08:02:25.6827821+00:00","lastSuccessAt":"2026-11-09T07:02:22.9878009+00:00","error":"HttpRequestException","lastVerifiedAt":"2026-11-09T07:02:23.0094052+00:00","snapshotPublishedAt":"2026-11-09T06:27:21+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-0bc6adcd3c0c448aa2e9bc2063d5a999","complete":false,"records":13654,"lastAttemptAt":"2026-11-09T08:14:22.8145543+00:00","lastSuccessAt":"2026-11-09T08:14:22.81+00:00","error":"14 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-09T08:14:22.81+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13684,"expectedIdentifiers":13706,"failedIdentifiers":14},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-09T08:02:26.2193293+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-09T08:02:26.2193293+00:00","lastSuccessAt":"2026-11-09T08:02:26.3910394+00:00","error":null,"lastVerifiedAt":"2026-11-09T08:02:26.3910397+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-156d67f0b09643159ff4bd684ee896db","complete":true,"records":13666,"lastAttemptAt":"2026-11-09T08:02:26.9587387+00:00","lastSuccessAt":"2026-11-09T07:04:26.209+00:00","error":null,"lastVerifiedAt":"2026-11-09T07:04:26.209+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13706,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-09T08:02:26.1458433+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-09T08:02:26.1458433+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-09T08:02:25.8338551+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-09T08:02:25.8338551+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f6d341f4320a5a0c059c28102ee651c3dd06abc87b84d2bafa4e2a823ec07d35","complete":true,"records":3056,"lastAttemptAt":"2026-11-09T08:02:26.1741996+00:00","lastSuccessAt":"2026-11-09T05:02:23.1539412+00:00","error":null,"lastVerifiedAt":"2026-11-09T08:02:26.1741996+00:00","snapshotPublishedAt":"2026-11-09T04:47:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-32fcf2a839d0d91a36b31c98096d6b8a1a8cc523d64745f8a939e306130e49f2","complete":true,"records":231296,"lastAttemptAt":"2026-11-09T08:02:25.9613255+00:00","lastSuccessAt":"2026-11-09T07:04:23.2641171+00:00","error":null,"lastVerifiedAt":"2026-11-09T08:02:25.9613255+00:00","snapshotPublishedAt":"2026-11-09T06:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}