Linux kernel libceph: unchecked decodes in decode_locker() let a malicious OSD read out of bounds

Impact

The in-kernel Ceph client parses locker records returned by an OSD without bounds-checking three decode steps, so a malicious or compromised OSD can walk the decode pointer past the validated buffer (including by sending a 32-bit length of 0xffffffff) and cause slab-out-of-bounds reads in kernel context. The realistic outcomes are a kernel crash of the client node and possible disclosure of adjacent slab contents; the record does not claim write primitives or code execution. This matters on GPU nodes that mount krbd or CephFS volumes for datasets and checkpoints, because the trust flows the wrong way: one storage node under an attacker's control reaches every compute node that issues lock.get_info, which RBD does on exclusive-lock acquisition. A crashed node in mid-training loses the job and takes a drain-and-reboot cycle to return.

Who can reach it

A malicious or compromised Ceph OSD that a kernel RBD/CephFS client talks to. Per the commit message, no privilege beyond establishing an OSD session is required; the attacker must be able to answer the client's lock.get_info request.

What to do

Update to a stable kernel containing the decode_locker() safe-decode fix and reboot each affected client node - there is no runtime toggle, and the parsing path is exercised by any normal RBD exclusive-lock acquisition. Nodes that mount Ceph volumes must be drained before reboot. Until patched, the only mitigation is limiting which OSDs kernel clients will talk to; the record names no fixed release numbers, only the stable commits.

References

Related entries

• Linux kernel AMD LBR: user-only branch sampling leaks kernel addresses to unprivileged usersCVE-2026-80602 · Linux kernel perf/x86/amd/lbr (AMD LBR v2 branch stack filtering)Unscored
• Linux kernel iommufd: dma_buf_unpin() without dma_resv lock warns on every DMABUF IOAS teardownCVE-2026-80633 · Linux kernel iommufd (DMABUF-backed iopt_pages release path)Unscored
• Linux kernel CXL fwctl: supported-features query trips a fortify panic and takes the host downCVE-2026-80640 · Linux kernel cxl_core (fwctl get-supported-features path)Unscored
• Linux ccp/SEV: zero-length cert chain in PDH export hits a BUG_ON on CONFIG_DEBUG_VIRTUAL kernelsCVE-2026-80652 · Linux kernel crypto/ccp AMD PSP driver (SEV PDH export ioctl)Unscored
• Linux BPF LSM: attaching to xfrm_decode_session turns packet classification into a kernel panicCVE-2026-80669 · Linux kernel BPF LSM (xfrm_decode_session hook attachment)Unscored
• Linux kernel migrate_device: pte_pfn/pte_dirty called on non-present PTEs during device migrationCVE-2026-80686 · Linux kernel mm/migrate_device (migrate_vma_collect_pmd non-present PTE handling)Unscored