CVE-2026-80558

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

libceph: Avoid using invalid osd indices from primary_temp

A corrupted osdmap received from a Ceph monitor or OSD may contain osd

indices in its pg_temp, primary_temp, pg_upmap, and pg_upmap_items parts

that don't exist, i.e., that are greater than max_osd or smaller than

CEPH_HOMELESS_OSD (-1). These indices are used to create the up and

acting set in ceph_pg_to_up_acting_osds(), called from calc_target().

While most of these osd indices are checked, the one from primary_temp

is not. Subsequently, this may lead to calc_target() returning this

(potentially invalid) index as target osd for a (linger) request.

Because the osd_state, osd_weight, and osd_addr arrays only contain

max_osd entries (with indices 0 to max_osd -1), this leads to

out-of-bounds accesses when trying to read values from these arrays.

This patch fixes the issue by adding a check to get_temp_osds(), so that

only valid osd indices from primary_temp

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References