CVE-2026-80558

A flaw was found in libceph within the Linux kernel. A remote attacker, by sending a specially crafted or corrupted OSD map (osdmap) from a Ceph monitor or OSD, could cause the system to attempt to access memory outside of allocated bounds. This out-of-bounds access occurs because invalid OSD indices in the primary_temp section of the osdmap are not properly validated. Successful exploitation of this vulnerability could lead to a denial of service.

A corrupted Ceph osdmap received from a monitor or OSD can contain an invalid primary_temp OSD index that is outside the valid 0 to max_osd range. libceph could accept this value as the target OSD for a request and then use it to read osd_state, osd_weight, or osd_addr arrays out of bounds. For the CVSS the PR:N is used because the attacker does not need local privileges on the victim host, but practical triggering usually requires a malicious or compromised Ceph monitor or OSD, or the ability to tamper with trusted Ceph cluster traffic. The issue is network reachable in Ceph deployments where the client accepts osdmaps from a reachable cluster endpoint, but these networks are normally internal storage networks rather than public Internet services. Impact is at least denial of service and may include limited confidentiality or integrity impact because an out of bounds read can influence target selection or consume unintended kernel memory values.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.