CVE-2026-22991: libceph: make free_choose_arg_map() resilient to partial allocation
In the Linux kernel, the following vulnerability has been resolved:
libceph: make freechooseargmap() resilient to partial allocation
freechooseargmap() may dereference a NULL pointer if its caller fails after a partial allocation.
For example, in decodechooseargs(), if allocation of argmap->args fails, execution jumps to the fail label and freechooseargmap() is called. Since argmap->size is updated to a non-zero value before memory allocation, freechooseargmap() will iterate over argmap->args and dereference a NULL pointer.
To prevent this potential NULL pointer dereference and make freechooseargmap() more resilient, add checks for pointers before iterating.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22991?
CVE-2026-22991 has a severity that warrants serious attention due to its potential to cause NULL pointer dereferences.
How do I fix CVE-2026-22991?
To fix CVE-2026-22991, ensure you update your Linux kernel to the latest patched version.
Which software is affected by CVE-2026-22991?
CVE-2026-22991 affects the Linux kernel, specifically components related to libceph.
What are the potential consequences of CVE-2026-22991?
Exploitation of CVE-2026-22991 may lead to denial of service due to unexpected application crashes.
When was CVE-2026-22991 disclosed?
CVE-2026-22991 was disclosed as part of ongoing security updates in the Linux kernel.