CVE-2026-80558

In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid osd indices from primarytemp A corrupted osdmap received from a Ceph monitor or OSD may contain osd indices in its pgtemp, primarytemp, pgupmap, and pgupmapitems parts that don't exist, i.e., that are...

AZL-97689 CVE-2026-80528 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ceph: avoid fs reclaim while using current-journalinfo handlereply stores a cephmdsrequest pointer in current-journalinfo while filling the inode and dentry cache from an MDS reply. An allocation in this section can enter direct...

CVE-2026-80527

In the Linux kernel, the following vulnerability has been resolved: ceph: fix hanging cephgetcaps with stale mdswanted A reader can hang forever in cephgetcaps when the client no longer holds FILERD, but local cap state still says that the capability is already wanted via mdswanted. One way to...

AZL-97677 CVE-2026-80527 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ceph: fix hanging cephgetcaps with stale mdswanted A reader can hang forever in cephgetcaps when the client no longer holds FILERD, but local cap state still says that the capability is already wanted via mdswanted. One way to...

CVE-2026-80528

In the Linux kernel, the following vulnerability has been resolved: ceph: avoid fs reclaim while using current-journalinfo handlereply stores a cephmdsrequest pointer in current-journalinfo while filling the inode and dentry cache from an MDS reply. An allocation in this section can enter direct...

CVE-2026-80527

In the Linux kernel, the following vulnerability has been resolved: ceph: fix hanging cephgetcaps with stale mdswanted A reader can hang forever in cephgetcaps when the client no longer holds FILERD, but local cap state still says that the capability is already wanted via mdswanted. One way to...

CVE-2026-80528

In the Linux kernel, the following vulnerability has been resolved: ceph: avoid fs reclaim while using current-journalinfo handlereply stores a cephmdsrequest pointer in current-journalinfo while filling the inode and dentry cache from an MDS reply. An allocation in this section can enter direct...

UBUNTU-CVE-2026-80561

In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe decodes in decodelocker decodelocker in clslockclient.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecodecopy at the...

CVE-2026-80561

In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe decodes in decodelocker decodelocker in clslockclient.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecodecopy at the...

CVE-2026-80558

In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid osd indices from primarytemp A corrupted osdmap received from a Ceph monitor or OSD may contain osd indices in its pgtemp, primarytemp, pgupmap, and pgupmapitems parts that don't exist, i.e., that are...

CVE-2026-80557

In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decodewatchers via missing bounds check cephstartdecoding validates that structlen bytes remain in the buffer after the encoding header, but accepts structlen=0 as valid: cephdecodeneedp, end, 0, bad alwa...

UBUNTU-CVE-2026-80558

In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid osd indices from primarytemp A corrupted osdmap received from a Ceph monitor or OSD may contain osd indices in its pgtemp, primarytemp, pgupmap, and pgupmapitems parts that don't exist, i.e., that are...

UBUNTU-CVE-2026-80527

In the Linux kernel, the following vulnerability has been resolved: ceph: fix hanging cephgetcaps with stale mdswanted A reader can hang forever in cephgetcaps when the client no longer holds FILERD, but local cap state still says that the capability is already wanted via mdswanted. One way to...

UBUNTU-CVE-2026-80528

In the Linux kernel, the following vulnerability has been resolved: ceph: avoid fs reclaim while using current-journalinfo handlereply stores a cephmdsrequest pointer in current-journalinfo while filling the inode and dentry cache from an MDS reply. An allocation in this section can enter direct...

CVE-2026-80561 libceph: fix multiple unsafe decodes in decode_locker()

In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe decodes in decodelocker decodelocker in clslockclient.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecodecopy at the...

CVE-2026-80561

CVE-2026-80561 is a critical (CVSS 9.8) vulnerability in the Linux kernel's libceph component. The decode_locker() function in cls_lock_client.c contains three unsafe decode operations with missing bounds checks, allowing a malicious or compromised OSD in a multi-tenant Ceph deployment to trigger...

CVE-2026-80561 libceph: fix multiple unsafe decodes in decode_locker()

In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe decodes in decodelocker decodelocker in clslockclient.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecodecopy at the...

CVE-2026-80557 libceph: fix OOB read in decode_watchers() via missing bounds check

In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decodewatchers via missing bounds check cephstartdecoding validates that structlen bytes remain in the buffer after the encoding header, but accepts structlen=0 as valid: cephdecodeneedp, end, 0, bad alwa...

CVE-2026-80558 libceph: Avoid using invalid osd indices from primary_temp

In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid osd indices from primarytemp A corrupted osdmap received from a Ceph monitor or OSD may contain osd indices in its pgtemp, primarytemp, pgupmap, and pgupmapitems parts that don't exist, i.e., that are...

CVE-2026-80558

This Linux kernel vulnerability affects the libceph subsystem. A corrupted osdmap received from a Ceph monitor or OSD may contain OSD indices in its primary_temp field that are greater than max_osd or smaller than CEPH_HOMELESS_OSD (-1). While most OSD indices in the osdmap are validated, the one...