Linux kernel libceph: unvalidated primary_temp OSD index causes out-of-bounds array reads

Impact

A corrupted osdmap from a monitor or OSD can carry OSD indices above max_osd or below CEPH_HOMELESS_OSD in pg_temp, primary_temp, pg_upmap and pg_upmap_items. Most of those are checked, but the index taken from primary_temp is not, so calc_target() can return it as the target OSD for a request or linger request. Because osd_state, osd_weight and osd_addr are sized to max_osd entries, the client then indexes past the end of those arrays. For a GPU fleet using RBD or CephFS from the kernel client, an attacker positioned to serve a crafted osdmap gets out-of-bounds reads inside the client kernel on every node that consumes the map.

Who can reach it

Anyone able to supply a crafted or corrupted osdmap to the kernel Ceph client - a compromised monitor or OSD on the storage network. No local user involvement; exposure follows whatever isolates the Ceph cluster network from tenants.

What to do

Apply the stable fix, which validates the primary_temp index in get_temp_osds() and falls back to the pg_temp primary or the up set when it is out of range. Five stable commits are listed; the record gives no fixed release version. Rollout is a patched kernel and a per-node reboot on every host running the kernel Ceph client, so drain GPU workloads first.

References

Related entries

• Linux kernel libceph: unchecked decodes in decode_locker() let a malicious OSD read out of boundsCVE-2026-80561 · Linux kernel libceph (cls_lock_client decode_locker)Unscored
• Linux kernel AMD LBR: user-only branch sampling leaks kernel addresses to unprivileged usersCVE-2026-80602 · Linux kernel perf/x86/amd/lbr (AMD LBR v2 branch stack filtering)Unscored
• Linux kernel iommufd: dma_buf_unpin() without dma_resv lock warns on every DMABUF IOAS teardownCVE-2026-80633 · Linux kernel iommufd (DMABUF-backed iopt_pages release path)Unscored
• Linux kernel CXL fwctl: supported-features query trips a fortify panic and takes the host downCVE-2026-80640 · Linux kernel cxl_core (fwctl get-supported-features path)Unscored
• Linux ccp/SEV: zero-length cert chain in PDH export hits a BUG_ON on CONFIG_DEBUG_VIRTUAL kernelsCVE-2026-80652 · Linux kernel crypto/ccp AMD PSP driver (SEV PDH export ioctl)Unscored
• Linux BPF LSM: attaching to xfrm_decode_session turns packet classification into a kernel panicCVE-2026-80669 · Linux kernel BPF LSM (xfrm_decode_session hook attachment)Unscored