{"id":"CVE-2026-80558","title":"libceph: Avoid using invalid osd indices from primary_temp","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Avoid using invalid osd indices from primary_temp\n\nA corrupted osdmap received from a Ceph monitor or OSD may contain osd\nindices in its pg_temp, primary_temp,…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 5e8d4d36bf23bb7baf027c479d54395840219928 < 505fc50b8ff8e687b7e3ef6866269dea27366224","Linux >= 5e8d4d36bf23bb7baf027c479d54395840219928 < 1c705fe8e59c6b16f48964973fb23c8ec4735b73","Linux >= 5e8d4d36bf23bb7baf027c479d54395840219928 < dfe1877d351b99eb1b1a62a3fc2d174220e88e20","Linux >= 5e8d4d36bf23bb7baf027c479d54395840219928 < e2ffeec85201b2bb748e99e12539ee1b92f62796","Linux >= 5e8d4d36bf23bb7baf027c479d54395840219928 < 6799d4a916ffcb3d450d8440f9fe0f0862f768d6","Linux >= 5e8d4d36bf23bb7baf027c479d54395840219928 < 4f392fec075562dc93bb0c69f37423ca2af9b48f","Linux >= 5e8d4d36bf23bb7baf027c479d54395840219928 < e009c5f0ad634c62f5c48a41f1f3c019ecf52555","Linux >= 5e8d4d36bf23bb7baf027c479d54395840219928 < 3660b98d1204b419f6a77e9a295f148dcf38d042","Linux 3.15"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-16T19:17:27.873915Z"},"published":"2026-08-26","updated":"2026-10-16","sourceUpdated":"2026-10-16T19:26:27.095Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80558","references":[{"url":"https://git.kernel.org/stable/c/505fc50b8ff8e687b7e3ef6866269dea27366224"},{"url":"https://git.kernel.org/stable/c/1c705fe8e59c6b16f48964973fb23c8ec4735b73"},{"url":"https://git.kernel.org/stable/c/dfe1877d351b99eb1b1a62a3fc2d174220e88e20"},{"url":"https://git.kernel.org/stable/c/e2ffeec85201b2bb748e99e12539ee1b92f62796"},{"url":"https://git.kernel.org/stable/c/6799d4a916ffcb3d450d8440f9fe0f0862f768d6"},{"url":"https://git.kernel.org/stable/c/4f392fec075562dc93bb0c69f37423ca2af9b48f"},{"url":"https://git.kernel.org/stable/c/e009c5f0ad634c62f5c48a41f1f3c019ecf52555"},{"url":"https://git.kernel.org/stable/c/3660b98d1204b419f6a77e9a295f148dcf38d042"}],"tags":["cve.org"],"epss":0.00514,"epssPercentile":0.42491,"ingestedAt":"2026-10-16T19:46:24.314Z","slug":"CVE-2026-80558","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Avoid using invalid osd indices from primary_temp\n\nA corrupted osdmap received from a Ceph monitor or OSD may contain osd\nindices in its pg_temp, primary_temp, pg_upmap, and pg_upmap_items parts\nthat don't exist, i.e., that are greater than max_osd or smaller than\nCEPH_HOMELESS_OSD (-1). These indices are used to create the up and\nacting set in ceph_pg_to_up_acting_osds(), called from calc_target().\nWhile most of these osd indices are checked, the one from primary_temp\nis not. Subsequently, this may lead to calc_target() returning this\n(potentially invalid) index as target osd for a (linger) request.\nBecause the osd_state, osd_weight, and osd_addr arrays only contain\nmax_osd entries (with indices 0 to max_osd -1), this leads to\nout-of-bounds accesses when trying to read values from these arrays.\n\nThis patch fixes the issue by adding a check to get_temp_osds(), so that\nonly valid osd indices from primary_temp are used, and it falls back to\nusing the primary from pg_temp or the up set if it is invalid.\n\n[ idryomov: changelog ]\n\n## Affected\n\n- `Linux >= 5e8d4d36bf23bb7baf027c479d54395840219928 < 505fc50b8ff8e687b7e3ef6866269dea27366224`\n- `Linux >= 5e8d4d36bf23bb7baf027c479d54395840219928 < 1c705fe8e59c6b16f48964973fb23c8ec4735b73`\n- `Linux >= 5e8d4d36bf23bb7baf027c479d54395840219928 < dfe1877d351b99eb1b1a62a3fc2d174220e88e20`\n- `Linux >= 5e8d4d36bf23bb7baf027c479d54395840219928 < e2ffeec85201b2bb748e99e12539ee1b92f62796`\n- `Linux >= 5e8d4d36bf23bb7baf027c479d54395840219928 < 6799d4a916ffcb3d450d8440f9fe0f0862f768d6`\n- `Linux >= 5e8d4d36bf23bb7baf027c479d54395840219928 < 4f392fec075562dc93bb0c69f37423ca2af9b48f`\n- `Linux >= 5e8d4d36bf23bb7baf027c479d54395840219928 < e009c5f0ad634c62f5c48a41f1f3c019ecf52555`\n- `Linux >= 5e8d4d36bf23bb7baf027c479d54395840219928 < 3660b98d1204b419f6a77e9a295f148dcf38d042`\n- `Linux 3.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}