CVE-2026-80558: libceph: Avoid using invalid osd indices from primary_temp
- Is it exploited?
Not on CISA's list. CISA has not added it to the Known Exploited Vulnerabilities catalog as of . If CISA adds it, this page shows it as known exploited.
- How likely is exploitation in the next 30 days?
- 0.5%
EPSS score, percentile 43.7 of all scored records. A probability estimated by FIRST, not a report of exploitation.
- How severe?
- 9.8 Critical
CVSS v3.1 base score, given by the CNA
- What should I do?
CISA has set no required action, because the vulnerability is not in KEV.
The CVE record links no vendor advisory, patch or mitigation.
- Which versions are affected?
Affected
- 3.15
Unaffected before 3.15; 5.10.266; 5.15.217; 6.1.184; 6.6.153; 6.12.105; and 3 more
Source: CISA KEV 2026.10.29, as of ; FIRST EPSS, as of ; CVE List, as of . About the data.
What to do
Advisories and patches
The CVE record links no vendor advisory, patch or mitigation.
This summary is based on the CVE record as of . Check the vendor's advisory before you act: affected versions and fixes can change.
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Affected | from 5e8d4d36bf23 to before 505fc50b8ff8 |
| Affected | from 5e8d4d36bf23 to before 1c705fe8e59c |
| Affected | from 5e8d4d36bf23 to before dfe1877d351b |
| Affected | from 5e8d4d36bf23 to before e2ffeec85201 |
| Affected | from 5e8d4d36bf23 to before 6799d4a916ff |
| Affected | from 5e8d4d36bf23 to before 4f392fec0755 |
| Affected | from 5e8d4d36bf23 to before e009c5f0ad63 |
| Affected | from 5e8d4d36bf23 to before 3660b98d1204 |
Versions not listed are: unaffected.
| Status | Versions |
|---|---|
| Affected | 3.15 |
| Unaffected | before 3.15 |
| Unaffected | 5.10.266 |
| Unaffected | 5.15.217 |
| Unaffected | 6.1.184 |
| Unaffected | 6.6.153 |
| Unaffected | 6.12.105 |
| Unaffected | 6.18.46 |
| Unaffected | 7.1.10 |
| Unaffected | 7.2 |
Versions not listed are: affected.
Versions the record lists as unaffected: 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, 7.2.
Source: CVE List, as of . About the data.
About this vulnerability
In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid osd indices from primary_temp A corrupted osdmap received from a Ceph monitor or OSD may contain osd indices in its pg_temp, primary_temp, pg_upmap, and pg_upmap_items parts that don't exist, i.e., that are greater than max_osd or smaller than CEPH_HOMELESS_OSD (-1). These indices are used to create…
Summary: CVE record, as of .
- CISA has not added CVE-2026-80558 to its Known Exploited Vulnerabilities (KEV) catalog, as of 29 Oct 2026.
- The CVE record was published on 26 Aug 2026.
- The CVE record carries a CVSS v3.1 base score of 9.8 (Critical), given by its CNA.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 0.5% (percentile 43.7), as of 29 Oct 2026. EPSS is a statistical estimate, not a report of exploitation.
- CISA's SSVC assessment in the CVE record: exploitation none, automatable yes, technical impact total.
Source: CISA KEV 2026.10.29, as of ; CVE List, as of ; FIRST EPSS, as of . About the data.
Description
libceph: Avoid using invalid osd indices from primary_temp
In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid osd indices from primary_temp A corrupted osdmap received from a Ceph monitor or OSD may contain osd indices in its pg_temp, primary_temp, pg_upmap, and pg_upmap_items parts that don't exist, i.e., that are greater than max_osd or smaller than CEPH_HOMELESS_OSD (-1). These indices are used to create the up and acting set in ceph_pg_to_up_acting_osds(), called from calc_target(). While most of these osd indices are checked, the one from primary_temp is not. Subsequently, this may lead to calc_target() returning this (potentially invalid) index as target osd for a (linger) request. Because the osd_state, osd_weight, and osd_addr arrays only contain max_osd entries (with indices 0 to max_osd -1), this leads to out-of-bounds accesses when trying to read values from these arrays. This patch fixes the issue by adding a check to get_temp_osds(), so that only valid osd indices from primary_temp are used, and it falls back to using the primary from pg_temp or the up set if it is invalid. [ idryomov: changelog ]
Source: CVE List, as of . About the data.
Timeline
| Date | Event |
|---|---|
| CVE record published | |
| CVE record last updated |
References
8
Known exploited Linux vulnerabilities
- CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability
- CVE-2025-39682: Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
- CVE-2025-39964: Linux Kernel Race Condition Vulnerability
- CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability
- CVE-2026-53362: Linux Kernel Unspecified Vulnerability