CVE-2026-80558

In the Linux kernel, the following vulnerability has been resolved:

libceph: Avoid using invalid osd indices from primary_temp

A corrupted osdmap received from a Ceph monitor or OSD may contain osd

indices in its pgtemp, primarytemp, pgupmap, and pgupmap_items parts

that don't exist, i.e., that are greater than max_osd or smaller than

CEPHHOMELESSOSD (-1). These indices are used to create the up and

acting set in cephpgtoupactingosds(), called from calctarget().

While most of these osd indices are checked, the one from primary_temp

is not. Subsequently, this may lead to calc_target() returning this

(potentially invalid) index as target osd for a (linger) request.

Because the osdstate, osdweight, and osd_addr arrays only contain

maxosd entries (with indices 0 to maxosd -1), this leads to

out-of-bounds accesses when trying to read values from these arrays.

This patch fixes the issue by adding a check to gettemposds(), so that

only valid osd indices from primary_temp are used, and it falls back to

using the primary from pg_temp or the up set if it is invalid.

[ idryomov: changelog ]