CVE-2026-80557

In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decodewatchers via missing bounds check cephstartdecoding validates that structlen bytes remain in the buffer after the encoding header, but accepts structlen=0 as valid: cephdecodeneedp, end, 0, bad alwa...

CVE-2026-80558

In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid osd indices from primarytemp A corrupted osdmap received from a Ceph monitor or OSD may contain osd indices in its pgtemp, primarytemp, pgupmap, and pgupmapitems parts that don't exist, i.e., that are...

CVE-2026-80561

In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe decodes in decodelocker decodelocker in clslockclient.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecodecopy at the...

UBUNTU-CVE-2026-80557

In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decodewatchers via missing bounds check cephstartdecoding validates that structlen bytes remain in the buffer after the encoding header, but accepts structlen=0 as valid: cephdecodeneedp, end, 0, bad alwa...

CVE-2026-80561 libceph: fix multiple unsafe decodes in decode_locker()

In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe decodes in decodelocker decodelocker in clslockclient.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecodecopy at the...

CVE-2026-80561

CVE-2026-80561 is a critical (CVSS 9.8) vulnerability in the Linux kernel's libceph component. The decode_locker() function in cls_lock_client.c contains three unsafe decode operations with missing bounds checks, allowing a malicious or compromised OSD in a multi-tenant Ceph deployment to trigger...

CVE-2026-80561 libceph: fix multiple unsafe decodes in decode_locker()

In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe decodes in decodelocker decodelocker in clslockclient.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecodecopy at the...

CVE-2026-80558

This Linux kernel vulnerability affects the libceph subsystem. A corrupted osdmap received from a Ceph monitor or OSD may contain OSD indices in its primary_temp field that are greater than max_osd or smaller than CEPH_HOMELESS_OSD (-1). While most OSD indices in the osdmap are validated, the one...

CVE-2026-80557 libceph: fix OOB read in decode_watchers() via missing bounds check

In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decodewatchers via missing bounds check cephstartdecoding validates that structlen bytes remain in the buffer after the encoding header, but accepts structlen=0 as valid: cephdecodeneedp, end, 0, bad alwa...

CVE-2026-80557 libceph: fix OOB read in decode_watchers() via missing bounds check

In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decodewatchers via missing bounds check cephstartdecoding validates that structlen bytes remain in the buffer after the encoding header, but accepts structlen=0 as valid: cephdecodeneedp, end, 0, bad alwa...

PT-2026-82177

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the Linux kernel, the decode locker function within cls lock client.c contains three unsafe decode operations. A malicious or compromised OSD Object Storage Device in a multi-tenant...

PT-2026-82173

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the libceph component. The ceph start decoding function allows a struct len value of 0, which can lead to a situation where no bytes are guaranteed for...

PT-2026-82174

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the libceph module where a corrupted osdmap received from a Ceph monitor or OSD may contain invalid osd indices in its pg temp, primary temp, pg upmap, and pg upmap...

Linux Distros Unpatched Vulnerability : CVE-2026-80561

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libceph: fix multiple unsafe decodes in decodelocker decodelocker in clslockclient.c contains three unsafe decode operations that allow a malicious or compromis...

Linux Distros Unpatched Vulnerability : CVE-2026-80557

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libceph: fix OOB read in decodewatchers via missing bounds check cephstartdecoding validates that structlen bytes remain in the buffer after the encoding header...

The vulnerability of the osd_fault() function in the net/ceph/osd_client.c module, which is part of the Linux kernel’s networking functions, allows a hacker to trigger a service failure.

The vulnerability of the osdfault function in the net/ceph/osdclient.c module, which implements kernel networking functions in the Linux operating system, is related to state management errors. Exploiting this vulnerability could allow a remote attacker to cause service failures...

The vulnerability in the ceph/osd_client.c component of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability in the ceph/osdclient.c component of the Linux operating system is related to errors during thread blocking. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-68158

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix multiplication overflow in decodenewupstateweight If a message of type CEPHMSGOSDMAP contains a maliciously corrupted osdmap, out-of-bounds memory accesses may occur in decodenewupstateweight. This happens because th...

CVE-2026-68154

In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crushdecode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crushdecode accepts a bucket with type 0, a malformed...

CVE-2026-68158 libceph: Fix multiplication overflow in decode_new_up_state_weight()

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix multiplication overflow in decodenewupstateweight If a message of type CEPHMSGOSDMAP contains a maliciously corrupted osdmap, out-of-bounds memory accesses may occur in decodenewupstateweight. This happens because th...