Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-80558

libceph: Avoid using invalid osd indices from primary_temp

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, and 2 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: yes
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid osd indices from primary_temp A corrupted osdmap received from a Ceph monitor or OSD may contain osd indices in its pg_temp, primary_temp, pg_upmap, and pg_upmap_items parts that don't exist, i.e., that are greater than max_osd or smaller than CEPH_HOMELESS_OSD (-1). These indices are used to create the up and acting set in ceph_pg_to_up_acting_osds(), called from calc_target(). While most of these osd indices are checked, the one from primary_temp is not. Subsequently, this may lead to calc_target() returning this (potentially invalid) index as target osd for a (linger) request. Because the osd_state, osd_weight, and osd_addr arrays only contain max_osd entries (with indices 0 to max_osd -1), this leads to out-of-bounds accesses when trying to read values from these arrays. This patch fixes the issue by adding a check to get_temp_osds(), so that only valid osd indices from primary_temp are used, and it falls back to using the primary from pg_temp or the up set if it is invalid. [ idryomov: changelog ]

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: yes · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From 5e8d4d36bf23bb7baf027c479d54395840219928 · fixed in 505fc50b8ff8e687b7e3ef6866269dea27366224; From 5e8d4d36bf23bb7baf027c479d54395840219928 · fixed in 1c705fe8e59c6b16f48964973fb23c8ec4735b73; From 5e8d4d36bf23bb7baf027c479d54395840219928 · fixed in dfe1877d351b99eb1b1a62a3fc2d174220e88e20; From 5e8d4d36bf23bb7baf027c479d54395840219928 · fixed in e2ffeec85201b2bb748e99e12539ee1b92f62796; From 5e8d4d36bf23bb7baf027c479d54395840219928 · fixed in 6799d4a916ffcb3d450d8440f9fe0f0862f768d6; From 5e8d4d36bf23bb7baf027c479d54395840219928 · fixed in 4f392fec075562dc93bb0c69f37423ca2af9b48f; From 5e8d4d36bf23bb7baf027c479d54395840219928 · fixed in e009c5f0ad634c62f5c48a41f1f3c019ecf52555; From 5e8d4d36bf23bb7baf027c479d54395840219928 · fixed in 3660b98d1204b419f6a77e9a295f148dcf38d042

  • Linux Linux

    3.15

  • KernelLinux

    From 3.15.0 · fixed in 5.10.266; From 5.11.0 · fixed in 5.15.217; From 5.16.0 · fixed in 6.1.184; From 6.2.0 · fixed in 6.6.153; From 6.7.0 · fixed in 6.12.105; From 6.13.0 · fixed in 6.18.46; From 6.19.0 · fixed in 7.1.10

References 8

git.kernel.org