Linux Kernel CVE-2026-80558

Requires the target host to be running the in-kernel Ceph client (CephFS or RBD) and connected to a Ceph cluster, and requires the attacker to be able to deliver a corrupted osdmap - specifically one whose primary_temp entry contains an OSD index greater than max_osd or less than CEPH_HOMELESS_OSD (-1). Concretely this means control of a Ceph monitor or OSD that the client trusts, or the ability to modify osdmap data in transit (feasible when cephx/msgr2 encryption is not enforced). Limiting factors: the client must actually consume the crafted primary_temp value via calc_target() for a placement group (linger requests are the noted path); hosts that do not use libceph are unaffected; and enforced authentication/encryption on the client-cluster channel substantially constrains the delivery of a tampered osdmap.

The published CVSS is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which materially overstates real-world risk for this bug. Exploitation is not against an arbitrary network service: the malicious input is a corrupted osdmap that must be delivered by a Ceph monitor or OSD that the client already trusts and is connected to, so the realistic attacker is a compromised/rogue cluster component or a monitor-in-the-middle position - not an unauthenticated internet attacker, which conflicts with the PR:N/AC:L framing. The concrete technical impact is an out-of-bounds read of kernel arrays, most plausibly causing a crash/DoS (and potentially limited kernel-memory disclosure), rather than the full C:H/I:H/A:H the score implies. There is no EPSS value, no KEV listing, and no evidence of a POC in the provided data, so all exploitation signals point to low practical likelihood despite the high base score - a mid-sized operator running CephFS/RBD should still patch promptly, but this is a defense-in-depth kernel hardening fix, not an emergency internet-facing exposure. Net: treat as important for hosts mounting untrusted or multi-tenant Ceph clusters, lower priority for tightly controlled internal clusters.

An attacker who controls or has compromised a Ceph monitor or OSD (or can tamper with osdmap traffic to a client) crafts an osdmap whose primary_temp mapping references an OSD index beyond max_osd. When a linger/request on the client triggers calc_target(), get_temp_osds() returns the invalid index and the kernel reads out of bounds from osd_state/osd_weight/osd_addr, crashing the client or potentially leaking adjacent kernel memory. No public exploit is known, and the required trusted-cluster position raises the practical bar.