CVE-2026-80558libceph: Avoid using invalid osd indices from primary_temp
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid osd indices from primary_temp A corrupted osdmap received from a Ceph monitor or OSD may contain osd indices in its pg_temp, primary_temp, pg_upmap, and pg_upmap_items parts that don't exist, i.e., that are greater than max_osd or smaller than CEPH_HOMELESS_OSD (-1). These indices are used to create the up and acting set in ceph_pg_to_up_acting_osds(), called from calc_target(). While most of these osd indices are checked, the one from primary_temp is not. Subsequently, this may lead to calc_target() returning this (potentially invalid) index as target osd for a (linger) request. Because the osd_state, osd_weight, and osd_addr arrays only contain max_osd entries (with indices 0 to max_osd -1), this leads to out-of-bounds accesses when trying to read values from these arrays. This patch fixes the issue by adding a check to get_temp_osds(), so that only valid osd indices from primary_temp are used, and it falls back to using the primary from pg_temp or the up set if it is invalid. [ idryomov: changelog ]
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 5e8d4d36bf23bb7baf027c479d54395840219928 before 505fc50b8ff8e687b7e3ef6866269dea27366224; 5e8d4d36bf23bb7baf027c479d54395840219928 builds before 1c705fe8e59c6b16f48964973fb23c8ec4735b73; from 5e8d4d36bf23bb7baf027c479d54395840219928 before dfe1877d351b99eb1b1a62a3fc2d174220e88e20; from 5e8d4d36bf23bb7baf027c479d54395840219928 before e2ffeec85201b2bb748e99e12539ee1b92f62796; from 5e8d4d36bf23bb7baf027c479d54395840219928 before 6799d4a916ffcb3d450d8440f9fe0f0862f768d6; 5e8d4d36bf23bb7baf027c479d54395840219928 builds before 4f392fec075562dc93bb0c69f37423ca2af9b48f; from 5e8d4d36bf23bb7baf027c479d54395840219928 before e009c5f0ad634c62f5c48a41f1f3c019ecf52555; from 5e8d4d36bf23bb7baf027c479d54395840219928 before 3660b98d1204b419f6a77e9a295f148dcf38d042 | CNA record |
References
- https://git.kernel.org/stable/c/505fc50b8ff8e687b7e3ef6866269dea27366224
- https://git.kernel.org/stable/c/1c705fe8e59c6b16f48964973fb23c8ec4735b73
- https://git.kernel.org/stable/c/dfe1877d351b99eb1b1a62a3fc2d174220e88e20
- https://git.kernel.org/stable/c/e2ffeec85201b2bb748e99e12539ee1b92f62796
- https://git.kernel.org/stable/c/6799d4a916ffcb3d450d8440f9fe0f0862f768d6
- https://git.kernel.org/stable/c/4f392fec075562dc93bb0c69f37423ca2af9b48f
- https://git.kernel.org/stable/c/e009c5f0ad634c62f5c48a41f1f3c019ecf52555
- https://git.kernel.org/stable/c/3660b98d1204b419f6a77e9a295f148dcf38d042
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.