Vulnerability in Linux Kernel Affecting Ceph Lock Clients

CVE-2026-80561

What is CVE-2026-80561?

A series of unsafe decode operations in the Linux kernel's Ceph implementation can lead to severe vulnerabilities in multi-tenant environments. Specifically, the unsafe use of pointers and bounds checks in the decode_locker() function allows a compromised object storage daemon (OSD) to exploit the system by creating conditions for slab-out-of-bounds reads. An attacker can manipulate data sent from the OSD, potentially leading to unauthorized access or system crashes. Mitigations include replacing unsafe functions with secure alternatives to ensure proper bounds checking and prevent exploitation.

References