Linux kernel libceph: unvalidated primary_temp OSD index causes out-of-bounds array reads

CVE-2026-80558Kernel, userspace & hypervisorcurated

Impact

A corrupted osdmap from a monitor or OSD can carry OSD indices above max_osd or below CEPH_HOMELESS_OSD in pg_temp, primary_temp, pg_upmap and pg_upmap_items. Most of those are checked, but the index taken from primary_temp is not, so calc_target() can return it as the target OSD for a request or linger request. Because osd_state, osd_weight and osd_addr are sized to max_osd entries, the client then indexes past the end of those arrays. For a GPU fleet using RBD or CephFS from the kernel client, an attacker positioned to serve a crafted osdmap gets out-of-bounds reads inside the client kernel on every node that consumes the map.

Who can reach it

Anyone able to supply a crafted or corrupted osdmap to the kernel Ceph client - a compromised monitor or OSD on the storage network. No local user involvement; exposure follows whatever isolates the Ceph cluster network from tenants.

What to do

Apply the stable fix, which validates the primary_temp index in get_temp_osds() and falls back to the pg_temp primary or the up set when it is out of range. Five stable commits are listed; the record gives no fixed release version. Rollout is a patched kernel and a per-node reboot on every host running the kernel Ceph client, so drain GPU workloads first.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-80558 https://git.kernel.org/stable/c/1c705fe8e59c6b16f48964973fb23c8ec4735b73 https://git.kernel.org/stable/c/3660b98d1204b419f6a77e9a295f148dcf38d042 https://git.kernel.org/stable/c/4f392fec075562dc93bb0c69f37423ca2af9b48f

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.