The Linux kernel's cls_lock_client.c file contained two unsafe bare decode operations in the decode_lockers() function. These operations lacked proper bounds checking, allowing a malicious or compromised Ceph OSD to cause slab-out-of-bounds reads. Specifically, ceph_decode_32(p) was called without verifying buffer length, leading to a 4-byte read past the buffer boundary when struct_len=0 was sent. Additionally, ceph_decode_8(p) was called after a loop that could advance the pointer exactly to the buffer end, causing a 1-byte out-of-bounds read. These unsafe reads could lead to memory corruption or influence over lock type discriminators used by kernel clients during lock.get_info calls, such as RBD exclusive lock acquisition. The fix replaces these bare decode calls with their safe counterparts (ceph_decode_32_safe and ceph_decode_8_safe) that perform proper bounds checks and handle errors correctly.

A malicious or compromised Ceph OSD in a multi-tenant environment can exploit this vulnerability to cause out-of-bounds memory reads on kernel clients issuing lock.get_info requests. This could lead to memory corruption or incorrect lock type handling, potentially impacting kernel stability or security in affected systems using Ceph. There is no indication of remote code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel by replacing unsafe decode operations with safe variants that include bounds checking and proper error handling. Users should apply the official kernel updates that include this patch once available. Since no vendor advisory or patch link is provided, check the Linux kernel mailing lists or official repositories for the patch and update guidance. No additional mitigations are indicated.