In the Linux kernel, the libceph decode_locker() routine in cls_lock_client.c contains multiple unsafe decode operations that allow a malicious or compromised Ceph Object Storage Daemon (OSD) to trigger out-of-bounds reads. The vulnerability arises because the code performs three decode steps—copying the locker name, advancing a pointer after the locker header, and decoding a length—without performing bounds checks, which can read memory beyond the intended buffer. The patch replaces unsafe functions with safe variants and returns –EINVAL on any bounds violation. These unchecked operations can lead to memory corruption.

This issue exists in all Linux kernel releases that include libceph without the recent patch. Any system running a Ceph client that may call lock.get_info in a multi‑tenant deployment is potentially affected. The flaw was identified in the kernel’s cls_lock_client.c file.

The lack of bounds checks makes the vulnerability straightforward to exploit from a compromised OSD; no elevated privileges are required beyond the OSD session. While no CVSS or EPSS score is provided, the potential for memory corruption and subsequent system instability suggests a high severity. The vulnerability is not currently listed in CISA’s KEV catalog, but operators should treat it with high risk until the patch is applied.