CVE-2026-68082 - Vulnerability Details

- libceph: fix two unsafe bare decodes in decode_lockers()

Description

In the Linux kernel, the following vulnerability has been resolved:

libceph: fix two unsafe bare decodes in decode_lockers()

decode_lockers() in cls_lock_client.c contains two bare decode operations
that allow a malicious or compromised OSD to trigger slab-out-of-bounds
reads:

1. ceph_decode_32(p) at the num_lockers field has no preceding bounds
check. ceph_start_decoding() accepts struct_len=0 as valid -- the
internal ceph_decode_need(p, end, 0, bad) always passes -- so when an
OSD sends struct_len=0, ceph_start_decoding() returns success with
p == end. The immediately following bare ceph_decode_32(p) then reads
4 bytes past the validated buffer boundary. The garbage value is
passed directly to kzalloc_objs() as the locker count.

The sibling function decode_watchers() in osd_client.c already uses
ceph_decode_32_safe() after its own ceph_start_decoding() call.
decode_lockers() was the only site using the bare variant.

2. ceph_decode_8(p) after the decode_locker() loop has no preceding
bounds check. If an OSD crafts num_lockers such that the loop
advances p exactly to end, the subsequent bare ceph_decode_8(p) reads
one byte past the validated buffer boundary. The result is passed
directly into *type, which is used as a lock type discriminator by
callers, giving an OSD-controlled one-byte OOB read with direct
influence over the lock type field.

Fix both by replacing bare operations with their safe variants:
ceph_decode_32(p) -> ceph_decode_32_safe(p, end, *num_lockers,
err_inval)
ceph_decode_8(p) -> ceph_decode_8_safe(p, end, *type,
err_free_lockers)

The goto targets differ intentionally:
err_inval: is a new label returning -EINVAL directly. It is used for
the pre-allocation failure path where *lockers is not yet allocated
and must not be passed to ceph_free_lockers().

err_free_lockers: is the existing label. It is used for the
post-allocation failure path where *lockers is allocated and must
be freed.

ret is set to -EINVAL before ceph_decode_8_safe() so that
err_free_lockers returns the correct error code on bounds violation.
Without this, err_free_lockers would return a stale ret value (0 from
the successful decode_locker() loop), silently swallowing the error.

-EINVAL is correct for both failure paths. The data received from the
OSD is structurally malformed. -ENOMEM would misrepresent the failure
class to callers and to stable@ backporters triaging error paths.

Attacker model: a malicious or compromised OSD in a multi-tenant Ceph
deployment can trigger this against any kernel client that issues the
lock.get_info class method (e.g. during RBD exclusive lock acquisition).

[ idryomov: trim changelog, formatting ]

Published: 2026-08-08

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability lies in libceph’s decode_lockers() function, where two unguarded decode calls allow a malicious or compromised Ceph OSD to send crafted data that causes the kernel to read beyond a verified buffer’s end. The resulting 4‑byte or 1‑byte overread can leak sensitive kernel memory and, because the data is used as a lock type discriminator, can influence lock behavior. While the flaw is an out‑of‑bounds read rather than a write, it may aid attackers in gathering information needed for subsequent attacks or in manipulating cluster lock semantics.

Affected Systems

Any Linux kernel that includes the cls_lock_client.c decode_lockers function before the commit a109a556 (or its equivalent in distribution kernels) is vulnerable. The advisory does not specify exact kernel version ranges, so all kernel releases preceding the patch are considered at risk until the update is applied.

Risk and Exploitability

The CVSS score of 9.8 classifies this as critical, but the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The flaw requires a malicious or compromised Ceph OSD to issue a malformed lock.get_info request to a kernel client, which is feasible in a multi‑tenant Ceph deployment where OSDs may be untrusted. The vulnerability is not listed in the CISA KEV catalog, yet its high severity and potential to undermine cluster security warrants prompt remediation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d4ed4a530562881cc5225050e42d96034f405aae`	affected	< c8ade01170a27d8ede0d761c255268af81e417f8
`d4ed4a530562881cc5225050e42d96034f405aae`	affected	< 001835c599899ef1bd3506a815110a6374451554
`d4ed4a530562881cc5225050e42d96034f405aae`	affected	< 7c422364acd93d7da1dfc27d6b54635a269653a1
`d4ed4a530562881cc5225050e42d96034f405aae`	affected	< 02430f6f729b297e803d0605871f0a670b4eafd6
`d4ed4a530562881cc5225050e42d96034f405aae`	affected	< 57ba829804fe6d34bbac3b826c4b15c1caa54862
`d4ed4a530562881cc5225050e42d96034f405aae`	affected	< 89df5d71f83f8e2781286798fd8ae5e42cf5f1a7
`d4ed4a530562881cc5225050e42d96034f405aae`	affected	< a54be593d0b749161b08a1e56189b2cb9114267a
`d4ed4a530562881cc5225050e42d96034f405aae`	affected	< a109a556115271ca7896dcda7b4b7e45e156c227

Linux

affected

Version	Status	Constraints
`4.9`	affected	—
`0`	unaffected	< 4.9
`5.10.266`	unaffected	≤ 5.10.*
`5.15.217`	unaffected	≤ 5.15.*
`6.1.184`	unaffected	≤ 6.1.*
`6.6.153`	unaffected	≤ 6.6.*
`6.12.105`	unaffected	≤ 6.12.*
`6.18.46`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[d4ed4a530562881cc5225050e42d96034f405aae,a54be593d0b749161b08a1e56189b2cb9114267a)`	affected	code_commit	—
`[d4ed4a530562881cc5225050e42d96034f405aae,a109a556115271ca7896dcda7b4b7e45e156c227)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.9`	affected	generic	—
`[0,4.9)`	unaffected	semver	—
`[7.1.6,7.2.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that incorporates commit a109a556 or later, applying distribution patches or vendor releases as applicable.
If no official update is available, apply the source code changes manually: replace the unsafe ceph_decode_32 and ceph_decode_8 calls in cls_lock_client.c with the safe variants ceph_decode_32_safe and ceph_decode_8_safe as described in the commit.
Limit the ability of Ceph OSDs to issue lock.get_info commands, ensuring that only authenticated and trusted OSDs can invoke lock services or disable the RPC if it is not required.

Generated by OpenCVE AI on October 20, 2026 at 13:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DLA	DLA-4788-1	linux-6.12 security update
Debian DSA	DSA-6466-1	linux security update
Ubuntu USN	USN-8781-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8887-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8888-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8889-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8887-2	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8888-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8887-3	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00499.

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/001835c599899ef1bd3506a815110a6374451554
https://git.kernel.org/stable/c/02430f6f729b297e803d0605871f0a670b4eafd6
https://git.kernel.org/stable/c/57ba829804fe6d34bbac3b826c4b15c1caa54862
https://git.kernel.org/stable/c/7c422364acd93d7da1dfc27d6b54635a269653a1
https://git.kernel.org/stable/c/89df5d71f83f8e2781286798fd8ae5e42cf5f1a7
https://git.kernel.org/stable/c/a109a556115271ca7896dcda7b4b7e45e156c227
https://git.kernel.org/stable/c/a54be593d0b749161b08a1e56189b2cb9114267a
https://git.kernel.org/stable/c/c8ade01170a27d8ede0d761c255268af81e417f8

History

Tue, 20 Oct 2026 05:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-129 CWE-535

Mon, 19 Oct 2026 21:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125

Sat, 17 Oct 2026 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sun, 23 Aug 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/001835c599899ef1bd3506a815110a6374451554 https://git.kernel.org/stable/c/02430f6f729b297e803d0605871f0a670b4eafd6 https://git.kernel.org/stable/c/57ba829804fe6d34bbac3b826c4b15c1caa54862 https://git.kernel.org/stable/c/7c422364acd93d7da1dfc27d6b54635a269653a1 https://git.kernel.org/stable/c/89df5d71f83f8e2781286798fd8ae5e42cf5f1a7 https://git.kernel.org/stable/c/c8ade01170a27d8ede0d761c255268af81e417f8

Fri, 14 Aug 2026 04:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-129 CWE-535

Fri, 14 Aug 2026 02:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119

Thu, 13 Aug 2026 22:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 08 Aug 2026 10:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119

Sat, 08 Aug 2026 09:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare decodes in decode_lockers() decode_lockers() in cls_lock_client.c contains two bare decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. ceph_decode_32(p) at the num_lockers field has no preceding bounds check. ceph_start_decoding() accepts struct_len=0 as valid -- the internal ceph_decode_need(p, end, 0, bad) always passes -- so when an OSD sends struct_len=0, ceph_start_decoding() returns success with p == end. The immediately following bare ceph_decode_32(p) then reads 4 bytes past the validated buffer boundary. The garbage value is passed directly to kzalloc_objs() as the locker count. The sibling function decode_watchers() in osd_client.c already uses ceph_decode_32_safe() after its own ceph_start_decoding() call. decode_lockers() was the only site using the bare variant. 2. ceph_decode_8(p) after the decode_locker() loop has no preceding bounds check. If an OSD crafts num_lockers such that the loop advances p exactly to end, the subsequent bare ceph_decode_8(p) reads one byte past the validated buffer boundary. The result is passed directly into type, which is used as a lock type discriminator by callers, giving an OSD-controlled one-byte OOB read with direct influence over the lock type field. Fix both by replacing bare operations with their safe variants: ceph_decode_32(p) -> ceph_decode_32_safe(p, end, num_lockers, err_inval) ceph_decode_8(p) -> ceph_decode_8_safe(p, end, type, err_free_lockers) The goto targets differ intentionally: err_inval: is a new label returning -EINVAL directly. It is used for the pre-allocation failure path where lockers is not yet allocated and must not be passed to ceph_free_lockers(). err_free_lockers: is the existing label. It is used for the post-allocation failure path where *lockers is allocated and must be freed. ret is set to -EINVAL before ceph_decode_8_safe() so that err_free_lockers returns the correct error code on bounds violation. Without this, err_free_lockers would return a stale ret value (0 from the successful decode_locker() loop), silently swallowing the error. -EINVAL is correct for both failure paths. The data received from the OSD is structurally malformed. -ENOMEM would misrepresent the failure class to callers and to stable@ backporters triaging error paths. Attacker model: a malicious or compromised OSD in a multi-tenant Ceph deployment can trigger this against any kernel client that issues the lock.get_info class method (e.g. during RBD exclusive lock acquisition). [ idryomov: trim changelog, formatting ]
Title		libceph: fix two unsafe bare decodes in decode_lockers()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/a109a556115271ca7896dcda7b4b7e45e156c227 https://git.kernel.org/stable/c/a54be593d0b749161b08a1e56189b2cb9114267a

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-08T09:17:45.394Z

Updated: 2026-10-19T20:48:44.160Z

Reserved: 2026-07-30T09:28:09.367Z

Link: CVE-2026-68082

Vulnrichment

Updated: 2026-10-16T15:43:34.384Z

NVD

Status : Received

Published: 2026-08-08T10:16:55.377

Modified: 2026-10-19T21:17:49.797

Link: CVE-2026-68082

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-20T14:00:16Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object