CVE-2026-80558: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80558 Overview

CVE-2026-80558 is an out-of-bounds access vulnerability in the Linux kernel's libceph subsystem. A corrupted osdmap received from a Ceph monitor or Object Storage Daemon (OSD) can contain invalid OSD indices in its primary_temp field. The libceph code validated indices from pg_temp, pg_upmap, and pg_upmap_items but failed to validate those from primary_temp. When calc_target() returns an invalid index, subsequent reads from the osd_state, osd_weight, and osd_addr arrays access memory outside their allocated bounds.

Critical Impact
A malicious or corrupted Ceph server can trigger out-of-bounds reads in kernel memory on any client mounting a CephFS or RBD volume, leading to information disclosure, kernel crashes, or potential exploitation for further impact.

Affected Products

Linux kernel libceph client subsystem
Systems using the in-kernel Ceph client for CephFS or RADOS Block Device (RBD)
Kernel branches fixed by commits 1c705fe, 3660b98, 4f392fe, 505fc50, 6799d4a, dfe1877, e009c5f, and e2ffeec

Discovery Timeline

2026-08-26 - CVE-2026-80558 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80558

Vulnerability Analysis

The libceph client receives osdmap structures from Ceph monitors and OSDs to route Placement Group (PG) requests to the correct storage daemon. These maps contain several fields, including pg_temp, primary_temp, pg_upmap, and pg_upmap_items, that override the default CRUSH-computed OSD placement. Each field references OSDs by integer index.

Valid OSD indices fall between CEPH_HOMELESS_OSD (-1) and max_osd - 1. The function ceph_pg_to_up_acting_osds() computes the up and acting sets from these fields and is called from calc_target() during request routing. While the kernel validated indices from three of the four fields, it did not validate values pulled from primary_temp.

An attacker controlling a Ceph monitor or OSD, or an on-path adversary able to inject a crafted osdmap, can supply a primary_temp index greater than max_osd or less than -1. calc_target() returns this attacker-controlled value as the target OSD, and later logic indexes into the osd_state, osd_weight, and osd_addr arrays without bounds checks.

Root Cause

The root cause is missing input validation on untrusted network data. The primary_temp field bypassed the bounds check applied to sibling fields in the same osdmap structure. This is a classic out-of-bounds read defect stemming from inconsistent validation across parallel code paths.

Attack Vector

Exploitation requires an attacker to deliver a malformed osdmap to the Linux kernel Ceph client. This can happen if a Ceph cluster is compromised, if a rogue monitor or OSD is introduced, or through network manipulation against an unauthenticated or weakly authenticated cluster. No local access to the client is required. The fix in get_temp_osds() validates the primary_temp index and falls back to the pg_temp primary or the up set when the value is invalid. Consult the upstream patch 1c705fe for the corrected logic.

Detection Methods for CVE-2026-80558

Indicators of Compromise

Kernel oops or panic messages referencing calc_target, get_temp_osds, or ceph_pg_to_up_acting_osds in dmesg or /var/log/kern.log
Unexpected client disconnects or I/O stalls on CephFS or RBD mounts correlated with osdmap epoch changes
KASAN reports flagging out-of-bounds reads in osd_state, osd_weight, or osd_addr arrays

Detection Strategies

Monitor kernel ring buffer output on Ceph clients for stack traces containing libceph symbols
Correlate Ceph monitor osdmap publication events with client-side crash timestamps to identify malicious map deliveries
Audit installed kernel package versions across fleet to identify hosts running unpatched libceph

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized SIEM for automated pattern matching on libceph faults
Alert on repeated client reconnections to Ceph monitors, which may indicate exploitation attempts causing kernel instability
Track Ceph monitor authentication logs to detect unauthorized peers publishing osdmap updates

How to Mitigate CVE-2026-80558

Immediate Actions Required

Apply the stable kernel update containing one of the fix commits (1c705fe, 3660b98, 4f392fe, 505fc50, 6799d4a, dfe1877, e009c5f, or e2ffeec) matching your kernel branch
Reboot affected hosts after installing the patched kernel to ensure the vulnerable libceph module is unloaded
Verify Ceph cluster monitor and OSD hosts have not been compromised, as an internal attacker is the primary threat model

Patch Information

The fix is available in the upstream Linux stable trees. See the primary patch commit and additional backport commits: 3660b98, 4f392fe, 505fc50, 6799d4a, dfe1877, e009c5f, and e2ffeec. Distribution vendors typically ship these fixes in their next stable kernel security release.

Workarounds

Enforce cephx authentication on all monitor and OSD connections to prevent unauthorized peers from publishing osdmap updates
Isolate Ceph cluster traffic on a dedicated management network segment with strict access controls
Unmount CephFS and RBD volumes on high-value hosts until the kernel patch is deployed if attacker access to the cluster is plausible

bash

# Verify running kernel includes the fix
uname -r
modinfo libceph | grep -E 'version|srcversion'

# Check kernel log for libceph faults
dmesg -T | grep -iE 'libceph|calc_target|get_temp_osds'