In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds read and panic due to the lack of validation for specific fields of packets sent by a client. The ldl_request_cancel function mishandles a large lock_count parameter.
https://review.whamcloud.com/#/c/36108/
https://jira.whamcloud.com/browse/LU-12603
http://wiki.lustre.org/Lustre_2.12.3_Changelog
http://lustre.org/
Source: Mitre, NVD
Published: 2020-01-27
Updated: 2026-06-17
Base Score: 7.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
Severity: High
Base Score: 7.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.00774