CVE-2026-68082

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The decode lockers() function in cls lock client.c contains two unsafe decode operations that allow a malicious or compromised Object Storage Device (OSD) to trigger slab-out-of-bounds reads. The first issue occurs when ceph decode 32(p) is called at the num lockers field without a preceding bounds check; if an OSD sends a structure length of 0, the function reads 4 bytes past the buffer boundary, passing a garbage value to kzalloc objs() as the locker count. The second issue occurs when ceph decode 8(p) is called after the decode locker() loop without a bounds check; if num lockers is crafted to advance the pointer exactly to the end of the buffer, the function reads one byte past the boundary into the type variable, which serves as a lock type discriminator. This can be triggered against any kernel client issuing the lock.get info class method, such as during RBD exclusive lock acquisition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.