CVE-2026-80561: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80561 Overview

CVE-2026-80561 is an out-of-bounds read vulnerability in the Linux kernel's libceph subsystem, specifically in the decode_locker() function within cls_lock_client.c. The function contains three unsafe decode operations that fail to validate buffer boundaries before advancing the decode pointer. A malicious or compromised Ceph Object Storage Daemon (OSD) can send crafted response data that triggers slab-out-of-bounds reads in any kernel client issuing the lock.get_info class method. This includes clients performing RBD exclusive lock acquisition. The vulnerability requires no additional privileges beyond OSD session establishment.

Critical Impact
A malicious or compromised OSD in a multi-tenant Ceph deployment can trigger kernel slab-out-of-bounds reads against any connected kernel client, potentially leading to information disclosure or kernel memory corruption.

Affected Products

Linux kernel libceph subsystem — cls_lock_client.c
Kernel RBD clients performing exclusive lock acquisition via lock.get_info
Multi-tenant Ceph deployments with kernel-side Ceph consumers

Discovery Timeline

2026-08-26 - CVE-2026-80561 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80561

Vulnerability Analysis

The decode_locker() function decodes locker records returned from an OSD in response to the lock.get_info class method. The function contains three distinct bounds-check failures that allow an attacker-controlled decode pointer p to advance past the validated buffer end.

The first defect is a ceph_decode_copy() on the locker_id_t name field without a preceding bounds check. When ceph_start_decoding() accepts a struct_len of zero, p equals end, and the copy reads sizeof(ceph_entity_name) (9 bytes) past the validated boundary.

The second defect is an unchecked pointer advance *p += sizeof(struct ceph_timespec) after the locker_info_t header. A malicious OSD can position p past end, causing subsequent _safe checks to evaluate against an invalid boundary.

The third defect combines an unchecked len = ceph_decode_32(p) with an uncapped *p += len. An OSD returning len=0xffffffff advances p gigabytes past end, escaping the decode window entirely.

Root Cause

The root cause is missing input validation on wire-format data from a network peer. The decoder mixes bare pointer arithmetic with _safe variants, defeating the safety guarantees. See [CWE-125] Out-of-Bounds Read and [CWE-20] Improper Input Validation.

Attack Vector

The attacker model requires a malicious or compromised OSD with an established session to a Linux kernel Ceph client. When the client issues lock.get_info — for example during RBD exclusive lock acquisition — the OSD returns a crafted locker response. The malformed structure lengths and 32-bit length fields drive the decoder pointer past valid memory.

The vulnerability manifests in the boundary validation logic of decode_locker(). Refer to the upstream patches in the Kernel Git Commit 1ed45c8 and related backports for the exact code paths and remediation.

Detection Methods for CVE-2026-80561

Indicators of Compromise

Kernel log entries containing KASAN: slab-out-of-bounds referencing decode_locker or cls_lock_client.
Unexpected client-side kernel oopses or panics correlating with RBD exclusive lock acquisition attempts.
Malformed OSD responses to lock.get_info observed via Ceph message tracing.

Detection Strategies

Enable KASAN on test kernels to surface out-of-bounds reads originating from libceph decoders.
Correlate kernel ring-buffer messages referencing libceph or rbd with OSD peer identities to identify suspect OSDs.
Inventory kernel versions across Ceph clients and flag hosts running builds that predate the fix commits listed by the Linux stable tree.

Monitoring Recommendations

Ship dmesg and journald kernel logs from Ceph clients into a centralized logging backend and alert on libceph, KASAN, and BUG: strings.
Monitor OSD authentication events and connection patterns to detect unauthorized or unexpected OSD peers in the cluster.
Track RBD lock acquisition failures, which may accompany triggered decode faults on client kernels.

How to Mitigate CVE-2026-80561

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 1ed45c8d9649, 3c3716dc06a3, 437b6551cfcc, 51c8d238fe72, 6265103e78f0, d1bba38574d0, dbfd83f722a7, and fa4aa86fff0c.
Update all Linux kernel Ceph clients to a stable kernel release that includes the libceph: fix multiple unsafe decodes in decode_locker() patch.
Audit multi-tenant Ceph deployments to confirm no untrusted parties operate OSDs sharing the cluster with sensitive kernel clients.

Patch Information

The fix replaces bare decode operations with their safe variants: ceph_decode_copy becomes ceph_decode_copy_safe, unchecked *p += sizeof(...) becomes ceph_decode_skip_n, ceph_decode_32(p) becomes ceph_decode_32_safe, and *p += len becomes ceph_decode_skip_n. A new error label returns -EINVAL on any bounds violation. Patch commits are available in the Kernel Git Commit 1ed45c8, Kernel Git Commit 3c3716d, and additional backports listed in the NVD references.

Workarounds

Restrict Ceph cluster membership so that all OSDs are operated by trusted administrators, eliminating the malicious-OSD attack model.
Isolate kernel RBD clients from any Ceph pools serviced by untrusted OSDs until patched kernels are deployed.
Prefer userspace librbd clients where feasible on unpatched hosts, since the vulnerable code path is in the kernel libceph decoder.

bash

# Verify the running kernel and confirm it includes the fix
uname -r
# Check distribution advisories for the backport corresponding to your kernel series
# Example: on Debian/Ubuntu
apt list --installed 2>/dev/null | grep linux-image
# Example: on RHEL/Rocky/Alma
rpm -q kernel