Linux kernel libceph: malicious OSD triggers out-of-bounds reads in RBD lock-info decode

Impact

A Ceph OSD that answers a kernel client's lock.get_info call can send a reply with struct_len=0 or a locker count that walks the decode pointer exactly to the end of the buffer. The client then reads 4 bytes past the validated buffer and passes that garbage straight to the allocator as a locker count, and reads one further byte past the end into the lock type discriminator that callers act on. That is a slab out-of-bounds read plus an OSD-controlled one-byte value flowing into kernel control flow, on the host kernel of any node that maps an RBD image with exclusive lock - which on GPU nodes is usually the path for dataset, checkpoint and scratch volumes. The NVD 9.8 network score overstates ordinary exposure: the attacker has to be, or be able to impersonate, an OSD the node already talks to.

Who can reach it

An attacker who controls a Ceph OSD in the cluster the node mounts from, or who can impersonate one on the storage network. No authentication to the affected node is required, and no tenant workload on the node is involved - a tenant that only sees a mounted filesystem cannot reach this.

What to do

Move to a stable kernel carrying the listed libceph fixes; the record names commits, not distribution versions, so check your vendor's advisory for the exact build. This is a kernel change, so each node has to be drained and rebooted unless your vendor ships it as a livepatch. Until then the practical mitigation is trusting the storage network: keep the Ceph cluster network off tenant-reachable paths and require cephx.

References

Related entries

• Linux libceph: CRUSH map with a zero bucket type makes the mapper index the OSD weight array negativelyCVE-2026-68154 · Linux kernel libceph (crush_decode, CRUSH map bucket type validation)Critical
• Linux libceph: stale authorizer buffer pointer after ticket refresh causes a use-after-free on msgr1 reconnectCVE-2026-68156 · Linux kernel libceph (ceph_x authorizer buffer, ceph_auth_handshake stale pointer)Critical
• Linux libceph: integer overflow in osdmap decoding defeats the bounds check and reads out of boundsCVE-2026-68158 · Linux kernel libceph (decode_new_up_state_weight, osdmap length arithmetic)Critical
• Linux kernel libceph: unbounded pg_temp length lets a malicious monitor cause a stack out-of-bounds writeCVE-2026-68159 · Linux kernel libceph (OSDMap pg_temp / pg_upmap / pg_upmap_items decode)Critical
• CephFS kernel client (ceph.ko, ceph_handle_caps): The kernel trusts snap_trace_len straight off the wire, so aCVE-2026-68160 · CephFS kernel client (ceph.ko, ceph_handle_caps)Critical
• Linux kernel (net/xfrm): When IPsec crypto offload takes a GSO segment asynchronously, the segment is unlinked from theCVE-2026-68426 · Linux kernel (net/xfrm)Critical