Executive brief
A memory corruption vulnerability exists in the Linux kernel's Ceph client library used for distributed storage operations. A malicious or compromised Ceph storage server can trigger out-of-bounds memory reads in kernel clients performing lock operations (such as RBD exclusive lock acquisition), potentially leading to sensitive data exposure or system crash. This affects any multi-tenant Ceph deployment where clients interact with untrusted storage nodes.
Technical details
The vulnerability consists of three unsafe decode operations in the decode_locker() function in cls_lock_client.c. First, ceph_decode_copy() lacks bounds checking on the locker_id_t name field, allowing reads 9 bytes past the buffer boundary when struct_len=0. Second, an unchecked pointer advance via *p += sizeof(struct ceph_timespec) can position the pointer past the buffer end, causing subsequent safety checks to fail against a bogus boundary. Third, ceph_decode_32() reads an uncapped length value that is immediately used in an unchecked pointer advance, allowing a malicious OSD to send len=0xffffffff and advance the pointer gigabytes past the buffer end. The fix replaces all unsafe operations with their safe variants (ceph_decode_copy_safe, ceph_decode_skip_n, ceph_decode_32_safe) and adds bounds violation error handling. Attack preconditions require network access to a Ceph OSD and an active client session, but no elevated privileges or user interaction are required.
Affected products
- Linux Linux kernel Unfixed versions prior to this patch
Timeline
- 2026-08-26: disclosed
- 2026-08-26: patched