Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-80558— libceph: Avoid using invalid osd indices from primary_temp

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： libceph：避免使用来自 primary_temp 的无效 OSD 索引 从 Ceph 监控器（monitor）或 OSD 接收到的损坏的 osdmap，其 pg_temp、primary_temp、pg_upmap 和 pg_upmap_items 部分可能包含不存在的 OSD 索引，即大于 或小于 （-1）的索引。这些索引被 调用的 函数用于构建 up 集合和 acting 集合。虽然其中大部分 OSD 索引都经过了检查，但来自 的索引未被检查。因此，这可能导致

CVSS 9.8 · Critical EPSS 0.51% · P42

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 5e8d4d36bf23bb7baf027c479d54395840219928< 505fc50b8ff8e687b7e3ef6866269dea27366224 affected
5e8d4d36bf23bb7baf027c479d54395840219928< 1c705fe8e59c6b16f48964973fb23c8ec4735b73 affected
5e8d4d36bf23bb7baf027c479d54395840219928< dfe1877d351b99eb1b1a62a3fc2d174220e88e20 affected
5e8d4d36bf23bb7baf027c479d54395840219928< e2ffeec85201b2bb748e99e12539ee1b92f62796 affected
5e8d4d36bf23bb7baf027c479d54395840219928< 6799d4a916ffcb3d450d8440f9fe0f0862f768d6 affected
5e8d4d36bf23bb7baf027c479d54395840219928< 4f392fec075562dc93bb0c69f37423ca2af9b48f affected
5e8d4d36bf23bb7baf027c479d54395840219928< e009c5f0ad634c62f5c48a41f1f3c019ecf52555 affected
5e8d4d36bf23bb7baf027c479d54395840219928< 3660b98d1204b419f6a77e9a295f148dcf38d042 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80558

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
libceph: Avoid using invalid osd indices from primary_temp
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid osd indices from primary_temp A corrupted osdmap received from a Ceph monitor or OSD may contain osd indices in its pg_temp, primary_temp, pg_upmap, and pg_upmap_items parts that don't exist, i.e., that are greater than max_osd or smaller than CEPH_HOMELESS_OSD (-1). These indices are used to create the up and acting set in ceph_pg_to_up_acting_osds(), called from calc_target(). While most of these osd indices are checked, the one from primary_temp is not. Subsequently, this may lead to calc_target() returning this (potentially invalid) index as target osd for a (linger) request. Because the osd_state, osd_weight, and osd_addr arrays only contain max_osd entries (with indices 0 to max_osd -1), this leads to out-of-bounds accesses when trying to read values from these arrays. This patch fixes the issue by adding a check to get_temp_osds(), so that only valid osd indices from primary_temp are used, and it falls back to using the primary from pg_temp or the up set if it is invalid. [ idryomov: changelog ]
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 5e8d4d36bf23bb7baf027c479d54395840219928 ~ 505fc50b8ff8e687b7e3ef6866269dea27366224 -
Linux Linux 3.15 -

II. Public POCs for CVE-2026-80558

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80558

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-80558 (7)

Vendor Advisories for CVE-2026-80558 (1)

Same Patch Batch · Linux · 2026-08-26 · 92 CVEs total

CVE-2026-80589 9.8 CRITICAL block: stop the timeout timer when releasing a never added disk
CVE-2026-74752 9.8 CRITICAL sctp: validate cookie AUTH state before use
CVE-2026-80519 9.8 CRITICAL ovpn: finish crypto callback cleanup before peer release
CVE-2026-74746 9.8 CRITICAL netfilter: flowtable: publish GC-visible tuple last
CVE-2026-80528 9.8 CRITICAL ceph: avoid fs reclaim while using current->journal_info
CVE-2026-74744 9.8 CRITICAL ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
CVE-2026-74743 9.8 CRITICAL macvlan: inherit needed_headroom and needed_tailroom from lowerdev
CVE-2026-80561 9.8 CRITICAL libceph: fix multiple unsafe decodes in decode_locker()
CVE-2026-80586 9.8 CRITICAL mptcp: options: reset DSS fields in case of unexpected size
CVE-2026-80557 9.8 CRITICAL libceph: fix OOB read in decode_watchers() via missing bounds check
CVE-2026-74737 9.8 CRITICAL net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
CVE-2026-80587 9.8 CRITICAL mptcp: avoid combining some incoming suboptions
CVE-2026-80585 9.4 CRITICAL mptcp: fastopen: only mark MPTFO subflows with SYN data
CVE-2026-74751 9.4 CRITICAL riscv: lib: Fix ZBB strnlen reading past count boundary
CVE-2026-80554 9.3 CRITICAL s390/vfio_ccw: Limit the number of channel program segments
CVE-2026-80551 9.3 CRITICAL s390/vfio_ccw: Ensure first IDAW remains constant
CVE-2026-80576 8.8 HIGH drm/amdgpu: reject oversized IBs with per-ring packet limits
CVE-2026-80553 8.8 HIGH s390/vfio_ccw: Cancel existing workqueues
CVE-2026-80552 8.8 HIGH s390/vfio_ccw: Ensure index for read/write regions are within range
CVE-2026-80547 8.8 HIGH s390/vfio_ccw: Implement a crw lock

Showing top 20 of 92 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-80558

No comments yet

Leave a comment