CVE-2026-22990
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A vulnerability in the Linux kernel has been resolved in libceph, concerning the overzealous use of BUG_ON in the osdmap_apply_incremental() function. If the osdmap is maliciously corrupted, it should be declared invalid instead of triggering a bug.
Risk Assessment
Malicious corruption of the osdmap could lead to system instability and data security issues. Improper error handling may allow attackers to exploit this vulnerability.
Recommendation
It is recommended to update the Linux kernel to the latest version to eliminate this vulnerability. Additionally, monitor the integrity of the osdmap to detect potential attacks.
Other vulnerabilities in Linux kernel, libceph
See all- CVE-2026-43304Critical
A vulnerability in the Linux kernel related to the libceph library has been resolved, concerning key length verification. The new CEPH_MAX_KEY_LEN check ensures that the key material fits into a fixed-size buffer.
- CVE-2026-90067High
In the Linux kernel, the libceph module (Ceph messenger v2 protocol) did not validate the payload_len field in the banner prefix. A client could send a banner with payload_len of 0, causing a 0-length socket read and violating a state machine invariant, triggering a warning in populate_in_iter(). Per the msgr2 specification, payload_len must be at least 16 bytes.
- CVE-2026-46024High
A vulnerability has been identified in the Linux kernel within libceph that may lead to a null pointer dereference in the ceph_handle_auth_reply() function. The issue occurs when a CEPH_MSG_AUTH_REPLY message contains zero values for both protocol and result, which is not currently treated as an error.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() If the osdmap is (maliciously) corrupted such that the incremental osdmap epoch is different from what is expected, there is no need to BUG. Instead, just declare the incremental osdmap to be invalid.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS