Look up another CVE · open CVE-2026-80558 in the interactive tracker
CVE-2026-80558
libceph: Avoid using invalid osd indices from primary_temp
Published 2026-08-26 (2 months ago) by the Linux kernel CNA. Subsystem net/ceph. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-80558 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4777-1 · 2026-09-08 · text | 6.1.187-1 | Update the kernel and reboot. DLA-4777-1 shipped the fix on 2026-09-08, in 6.1.187-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.105-1 | Update the kernel and reboot. Fixed in 6.12.105-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.10-1 | Update the kernel and reboot. Fixed in 7.1.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.10-1 | Update the kernel and reboot. Fixed in 7.1.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4788-1 · 2026-09-19 · text | 6.12.107-1~deb12u1 | Update the kernel and reboot. DLA-4788-1 shipped the fix on 2026-09-19, in 6.12.107-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
A corrupted osdmap received from a Ceph monitor or OSD may contain osd indices in its pg_temp, primary_temp, pg_upmap, and pg_upmap_items parts that don't exist, i.e., that are greater than max_osd or smaller than CEPH_HOMELESS_OSD (-1). These indices are used to create the up and acting set in ceph_pg_to_up_acting_osds(), called from calc_target(). While most of these osd indices are checked, the one from primary_temp is not. Subsequently, this may lead to calc_target() returning this (potentially invalid) index as target osd for a (linger) request. Because the osd_state, osd_weight, and osd_addr arrays only contain max_osd entries (with indices 0 to max_osd -1), this leads to out-of-bounds accesses when trying to read values from these arrays. This patch fixes the issue by adding a check to get_temp_osds(), so that only valid osd indices from primary_temp are used, and it falls back to using the primary from pg_temp or the up set if it is invalid. [ idryomov: changelog ]
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/ceph/osdmap.c
- What this is
- CEPH COMMON CODE (LIBCEPH)MAINTAINERS section matched on net/ceph/ · ceph-devel@vger.kernel.org · Supported
- Kernel module
- libceph
Check it on the machine
grep -w CONFIG_CEPH_LIB /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w libcephPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sid, bookworm · linux-6.12m
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switch
- CONFIG_CEPH_LIB
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-26 (2 months ago)source
- CVSS
- 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.51%, higher than 42.5% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/ceph
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 3.15 | 5.10.266 | 505fc50b8ff8 |
| 3.15 | 5.15.217 | 1c705fe8e59c |
| 3.15 | 6.1.184 | dfe1877d351b |
| 3.15 | 6.6.153 | e2ffeec85201 |
| 3.15 | 6.12.105 | 6799d4a916ff |
| 3.15 | 6.18.46 | 4f392fec0755 |
| 3.15 | 7.1.10 | e009c5f0ad63 |
| 3.15 | 7.2 | 3660b98d1204 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4788-1 | 2026-09-19 | bookworm 6.12.107-1~deb12u1 | tracker |
| DLA-4777-1 | 2026-09-08 | bookworm 6.1.187-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- Malformed primary_temp data arrives in CEPH_MSG_OSD_MAP over TCP from a Ceph monitor (mon_dispatch) or OSD (osd_dispatch); calc_target() then uses the bogus osd index in lookup_create_osd()/reopen_osd() to index osd_addr/osd_state/osd_weight without any local syscall.
- AC:LAttack complexity, low
- A compromised or malicious monitor/OSD can publish an incremental osdmap whose primary_temp sets an osd index >= max_osd for a victim PG; once applied, calc_target() on pending I/O, linger requests, or map-driven resends deterministically uses that invalid index.
- PR:NPrivileges required, none
- The attacker acts as the remote Ceph cluster peer delivering forged osdmaps to an already-connected kernel CephFS/RBD client and needs no local account, capabilities, or user-namespace privileges on the victim host.
- UI:NUser interaction, none
- Once a kernel Ceph client session exists, osdmap updates are applied automatically and scan_requests/kick_requests recalculate targets without any mount, open, or other victim interaction at exploit time.
- S:UScope, unchanged
- Impact is confined to kernel libceph client memory and state on the Ceph client host (heap disclosure, misrouted connections, crash); it does not cross VM, IOMMU, or container sandbox boundaries to another security authority.
- C:HConfidentiality impact, high
- Invalid acting.primary indexes past the end of kmalloc-backed osd_addr, osd_state, and osd_weight arrays, performing out-of-bounds reads of adjacent kernel heap memory that can disclose pointers and other sensitive data.
- I:HIntegrity impact, high
- Attacker-chosen osd indices drive out-of-bounds reads whose results are treated as authoritative OSD addresses and state for ceph_con_open() and request routing, corrupting kernel client connection targeting in ways usable for further exploitation.
- A:HAvailability impact, high
- Out-of-bounds reads with large crafted osd indices can fault on unmapped kmalloc slack and trigger kernel oops or panic; misrouted linger and I/O requests also cause persistent, repeatable client failure on each malicious osdmap update.