CVE-2026-80558

Status: UPDATED  |  Advisory ID: CVE-2026-80558

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

libceph: Avoid using invalid osd indices from primary_temp

A corrupted osdmap received from a Ceph monitor or OSD may contain osd

indices in its pg_temp, primary_temp, pg_upmap, and pg_upmap_items parts

that don't exist, i.e., that are greater than max_osd or smaller than

CEPH_HOMELESS_OSD (-1). These indices are used to create the up and

acting set in ceph_pg_to_up_acting_osds(), called from calc_target().

While most of these osd indices are checked, the one from primary_temp

is not. Subsequently, this may lead to calc_target() returning this

(potentially invalid) index as target osd for a (linger) request.

Because the osd_state, osd_weight, and osd_addr arrays only contain

max_osd entries (with indices 0 to max_osd -1), this leads to

out-of-bounds accesses when trying to read values from these arrays.

This patch fixes the issue by adding a check to get_temp_osds(), so that

only valid osd indices from primary_temp are used, and it falls back to

using the primary from pg_temp or the up set if it is invalid.

[ idryomov: changelog ] (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References