Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-80558— libceph: Avoid using invalid osd indices from primary_temp

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： libceph：避免使用来自 primary_temp 的无效 OSD 索引 从 Ceph 监控器（monitor）或 OSD 接收到的损坏的 osdmap，其 pg_temp、primary_temp、pg_upmap 和 pg_upmap_items 部分可能包含不存在的 OSD 索引，即大于 或小于 （-1）的索引。这些索引被 调用的 函数用于构建 up 集合和 acting 集合。虽然其中大部分 OSD 索引都经过了检查，但来自 的索引未被检查。因此，这可能导致

AI Predicted 5.1 Difficulty: Moderate

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 5e8d4d36bf23bb7baf027c479d54395840219928< 505fc50b8ff8e687b7e3ef6866269dea27366224 affected
5e8d4d36bf23bb7baf027c479d54395840219928< 1c705fe8e59c6b16f48964973fb23c8ec4735b73 affected
5e8d4d36bf23bb7baf027c479d54395840219928< dfe1877d351b99eb1b1a62a3fc2d174220e88e20 affected
5e8d4d36bf23bb7baf027c479d54395840219928< e2ffeec85201b2bb748e99e12539ee1b92f62796 affected
5e8d4d36bf23bb7baf027c479d54395840219928< 6799d4a916ffcb3d450d8440f9fe0f0862f768d6 affected
5e8d4d36bf23bb7baf027c479d54395840219928< 4f392fec075562dc93bb0c69f37423ca2af9b48f affected
5e8d4d36bf23bb7baf027c479d54395840219928< e009c5f0ad634c62f5c48a41f1f3c019ecf52555 affected
5e8d4d36bf23bb7baf027c479d54395840219928< 3660b98d1204b419f6a77e9a295f148dcf38d042 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80558

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
libceph: Avoid using invalid osd indices from primary_temp
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid osd indices from primary_temp A corrupted osdmap received from a Ceph monitor or OSD may contain osd indices in its pg_temp, primary_temp, pg_upmap, and pg_upmap_items parts that don't exist, i.e., that are greater than max_osd or smaller than CEPH_HOMELESS_OSD (-1). These indices are used to create the up and acting set in ceph_pg_to_up_acting_osds(), called from calc_target(). While most of these osd indices are checked, the one from primary_temp is not. Subsequently, this may lead to calc_target() returning this (potentially invalid) index as target osd for a (linger) request. Because the osd_state, osd_weight, and osd_addr arrays only contain max_osd entries (with indices 0 to max_osd -1), this leads to out-of-bounds accesses when trying to read values from these arrays. This patch fixes the issue by adding a check to get_temp_osds(), so that only valid osd indices from primary_temp are used, and it falls back to using the primary from pg_temp or the up set if it is invalid. [ idryomov: changelog ]
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 5e8d4d36bf23bb7baf027c479d54395840219928 ~ 505fc50b8ff8e687b7e3ef6866269dea27366224 -
Linux Linux 3.15 -

II. Public POCs for CVE-2026-80558

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80558

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-80558 (7)

Vendor Advisories for CVE-2026-80558 (1)

Same Patch Batch · Linux · 2026-08-26 · 92 CVEs total

CVE-2026-80557 libceph: fix OOB read in decode_watchers() via missing bounds check
CVE-2026-80553 s390/vfio_ccw: Cancel existing workqueues
CVE-2026-80552 s390/vfio_ccw: Ensure index for read/write regions are within range
CVE-2026-80549 s390/vfio_ccw: Move cp cleanup out of not operational
CVE-2026-80546 s390/zcrypt: Improve CCA CPRB length and overflow checks
CVE-2026-80547 s390/vfio_ccw: Implement a crw lock
CVE-2026-80545 s390/zcrypt: Improve EP11 CPRB length and overflow checks
CVE-2026-80543 s390/zcrypt: Pad trailing CCA or EP11 message with zeros
CVE-2026-80548 s390/vfio_ccw: Selectively expand io_mutex
CVE-2026-80555 s390/vfio_ccw: Free all memory if cp_init() fails
CVE-2026-80554 s390/vfio_ccw: Limit the number of channel program segments
CVE-2026-80556 mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition
CVE-2026-80559 Input: sur40 - fix input device registration ordering
CVE-2026-80560 openrisc: signal: do not restore privileged SR bits on sigreturn
CVE-2026-80561 libceph: fix multiple unsafe decodes in decode_locker()
CVE-2026-80562 gpio: ml-ioh: use raw_spinlock_t for the register lock
CVE-2026-80563 gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind
CVE-2026-80564 gve: fix NULL dereference due to missing ptp adjfine
CVE-2026-80565 crypto: qce - fix error path in devm_qce_register_algs
CVE-2026-80566 Input: hynitron_cstxxx - validate touch count and finger IDs

Showing top 20 of 92 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-80558

No comments yet

Leave a comment