CVE-2026-22990
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A vulnerability in the Linux kernel has been resolved in libceph, concerning the overzealous use of BUG_ON in the osdmap_apply_incremental() function. If the osdmap is maliciously corrupted, it should be declared invalid instead of triggering a bug.
Risk Assessment
Malicious corruption of the osdmap could lead to system instability and data security issues. Improper error handling may allow attackers to exploit this vulnerability.
Recommendation
It is recommended to update the Linux kernel to the latest version to eliminate this vulnerability. Additionally, monitor the integrity of the osdmap to detect potential attacks.
Other vulnerabilities in Linux kernel, libceph
See all- CVE-2026-43407Critical
In the Linux kernel, the ceph_handle_auth_reply() function in libceph contains an integer overflow vulnerability. The payload_len field from a CEPH_MSG_AUTH_REPLY message is stored as an int, so a value greater than INT_MAX becomes negative, leading to an out-of-bounds memory access. The fix changes the type to u32 and adds additional segment length sanity checks.
- CVE-2026-90067High
In the Linux kernel, the libceph module (Ceph messenger v2 protocol) did not validate the payload_len field in the banner prefix. A client could send a banner with payload_len of 0, causing a 0-length socket read and violating a state machine invariant, triggering a warning in populate_in_iter(). Per the msgr2 specification, payload_len must be at least 16 bytes.
- CVE-2026-46024High
A vulnerability has been identified in the Linux kernel within libceph that may lead to a null pointer dereference in the ceph_handle_auth_reply() function. The issue occurs when a CEPH_MSG_AUTH_REPLY message contains zero values for both protocol and result, which is not currently treated as an error.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() If the osdmap is (maliciously) corrupted such that the incremental osdmap epoch is different from what is expected, there is no need to BUG. Instead, just declare the incremental osdmap to be invalid.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS