CVE-2026-80561 libceph: fix multiple unsafe decodes in decode_locker()

🗓️ 26 Aug 2026 14:37:26Reported by LinuxType

Slab-out-of-bounds read in Linux libceph decode_locker() via malicious or compromised OSD.

Reporter	Title	Published	Views	Family All 16
Circl	CVE-2026-80561	27 Aug 202608:40	–	circl
CVE	CVE-2026-80561	26 Aug 202614:37	–	cve
Debian CVE	CVE-2026-80561	26 Aug 202614:37	–	debiancve
Oracle linux	Unbreakable Enterprise kernel security update	4 Sep 202600:00	–	oraclelinux
EUVD	EUVD-2026-66476	27 Aug 202606:31	–	euvd
NVD	CVE-2026-80561	26 Aug 202615:17	–	nvd
Tenable Nessus	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500249)	4 Sep 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2026-80561	26 Aug 202600:00	–	nessus
OSV	AZL-97784 CVE-2026-80561 affecting package kernel 6.6.150.1-1	26 Aug 202615:17	–	osv
OSV	BELL-CVE-2026-80561	29 Aug 202606:03	–	osv

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "net/ceph/cls_lock_client.c"
    ],
    "versions": [
      {
        "version": "d4ed4a530562881cc5225050e42d96034f405aae",
        "lessThan": "1ed45c8d96498725eb54f740172f9068d8673906",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "d4ed4a530562881cc5225050e42d96034f405aae",
        "lessThan": "6265103e78f0ee7e2518de9cf938b94bee9700a0",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "d4ed4a530562881cc5225050e42d96034f405aae",
        "lessThan": "3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "d4ed4a530562881cc5225050e42d96034f405aae",
        "lessThan": "fa4aa86fff0c56799c2e3f51a88879053285f4a9",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "d4ed4a530562881cc5225050e42d96034f405aae",
        "lessThan": "dbfd83f722a78446ec18a476ef7a38e52240b50a",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "d4ed4a530562881cc5225050e42d96034f405aae",
        "lessThan": "d1bba38574d095f191557d397d9633f08cd966b1",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "d4ed4a530562881cc5225050e42d96034f405aae",
        "lessThan": "51c8d238fe7236de627ab1a1433694552a904136",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "d4ed4a530562881cc5225050e42d96034f405aae",
        "lessThan": "437b6551cfcc235eea1d735a874f9d421f555e17",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "net/ceph/cls_lock_client.c"
    ],
    "versions": [
      {
        "version": "4.9",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "4.9",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "5.10.266",
        "lessThanOrEqual": "5.10.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "5.15.217",
        "lessThanOrEqual": "5.15.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.1.184",
        "lessThanOrEqual": "6.1.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.6.153",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.12.105",
        "lessThanOrEqual": "6.12.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.18.46",
        "lessThanOrEqual": "6.18.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.1.10",
        "lessThanOrEqual": "7.1.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.2",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]

Source	Link
git	www.git.kernel.org/stable/c/d1bba38574d095f191557d397d9633f08cd966b1
git	www.git.kernel.org/stable/c/1ed45c8d96498725eb54f740172f9068d8673906
git	www.git.kernel.org/stable/c/6265103e78f0ee7e2518de9cf938b94bee9700a0
git	www.git.kernel.org/stable/c/437b6551cfcc235eea1d735a874f9d421f555e17
git	www.git.kernel.org/stable/c/dbfd83f722a78446ec18a476ef7a38e52240b50a
git	www.git.kernel.org/stable/c/51c8d238fe7236de627ab1a1433694552a904136
git	www.git.kernel.org/stable/c/3c3716dc06a34e4ca7f743f5fcfa07fbc5a11070
git	www.git.kernel.org/stable/c/fa4aa86fff0c56799c2e3f51a88879053285f4a9

27 Aug 2026 05:01Current

CVSS 3.19.8

EPSS0.00521