CVE-2026-80561

A flaw was found in the Linux kernel's libceph component. A malicious or compromised Object Storage Device (OSD) can exploit multiple unsafe decode operations within the decode_locker() function. This can lead to slab-out-of-bounds reads, potentially allowing an attacker to disclose sensitive information or cause a denial of service.

Unsafe decode operations in libceph decode_locker() can let a malicious or compromised Ceph OSD make a kernel client read past the validated decode buffer while processing lock.get_info data. The bug class is slab out of bounds read, with possible kernel crash and possible limited exposure of adjacent kernel memory if copied data is later consumed or logged. For the CVSS the PR:L is used because reliable triggering typically requires control of an OSD endpoint or an authenticated Ceph storage peer rather than ordinary unauthenticated Internet access. The issue is network reachable inside the Ceph storage network and can affect clients that issue the lock.get_info class method, for example during RBD exclusive lock handling. Impact is at least denial of service via kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.