Out-of-bounds read in Linux kernel - CVE-2026-80558
Published: August 27, 2026
Vulnerability identifier: #VU145934
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-80558
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information, corrupt memory, or cause a denial of service.
The vulnerability exists due to out-of-bounds read in ceph_pg_to_up_acting_osds() and calc_target() when processing a corrupted osdmap containing an invalid primary_temp OSD index. A remote attacker can send a crafted osdmap with a nonexistent OSD index to trigger out-of-bounds array access to disclose sensitive information, corrupt memory, or cause a denial of service.
The issue occurs because the primary_temp OSD index was not properly validated before being used as the target OSD for a request.
Affected software
Linux kernel
How to mitigate CVE-2026-80558
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/1c705fe8e59c6b16f48964973fb23c8ec4735b73
- https://git.kernel.org/stable/c/3660b98d1204b419f6a77e9a295f148dcf38d042
- https://git.kernel.org/stable/c/4f392fec075562dc93bb0c69f37423ca2af9b48f
- https://git.kernel.org/stable/c/505fc50b8ff8e687b7e3ef6866269dea27366224
- https://git.kernel.org/stable/c/6799d4a916ffcb3d450d8440f9fe0f0862f768d6
- https://git.kernel.org/stable/c/dfe1877d351b99eb1b1a62a3fc2d174220e88e20
- https://git.kernel.org/stable/c/e009c5f0ad634c62f5c48a41f1f3c019ecf52555
- https://git.kernel.org/stable/c/e2ffeec85201b2bb748e99e12539ee1b92f62796