CVE-2026-68082

A flaw was found in libceph in the Linux kernel. Unsafe decoding operations within the decode_lockers() function allow a malicious or compromised Object Storage Device (OSD) to trigger out-of-bounds reads. By sending specially crafted input, an attacker can cause memory corruption. This could potentially lead to information disclosure or a denial of service.

An out-of-bounds read in libceph decode_lockers can occur because ceph_decode_32 and ceph_decode_8 were used without bounds checks after a decoded structure boundary. A malicious or compromised Ceph OSD can return malformed lock.get_info data with struct_len 0 or with the cursor advanced exactly to the end of the buffer, causing slab OOB reads in the kernel client. For the CVSS the PR:N because the attacker does not need privileges on the client host, but must be able to act as a malicious or compromised Ceph OSD or tamper with OSD traffic. The issue is network reachable in Ceph deployments where the client accepts replies from such an OSD, but it is normally limited to internal storage networks rather than the public Internet. Impact is at least denial of service through a kernel crash or bad allocation behavior. The paranoid impact uses C:L/I:L/A:H because the bug is a real OOB read and one decoded byte can influence the lock type discriminator, but there is no strong evidence of an arbitrary write primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.