PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-22991 Linux CVE debrief

A flaw in the Linux kernel's libceph component can lead to a NULL pointer dereference when free_choose_arg_map() is called after partial allocation. This issue arises when the function's caller, such as decode_choose_args(), fails after updating arg_map->size but before allocating arg_map->args. To address this, developers have added checks for pointers before iterating over them.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-01-23
Original CVE updated
2026-10-19
Advisory published
2026-01-23
Advisory updated
2026-10-19

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of Linux systems should assess their exposure to this vulnerability and apply patches or updates as necessary. They should also monitor for potential NULL pointer dereferences and verify Linux kernel versions for exposure.

Why it matters

This vulnerability can lead to NULL pointer dereferences in the Linux kernel's libceph component, potentially causing system instability or crashes. Linux kernel maintainers and users should assess exposure and apply patches to prevent potential issues.

  • Verify Linux kernel versions for exposure
  • Apply patches or updates to prevent NULL pointer dereferences
  • Monitor for potential NULL pointer dereferences

Technical summary

The free_choose_arg_map() function in the Linux kernel's libceph component does not handle partial allocation correctly, potentially leading to NULL pointer dereferences. This issue can occur when the function's caller fails after updating arg_map->size but before allocating arg_map->args. Developers have added checks for pointers before iterating over them to address this vulnerability. The vulnerability can cause system instability or crashes if exploited. Linux kernel maintainers and users should assess exposure and apply patches to prevent potential issues.

Defensive priority

Linux kernel maintainers and users should assess exposure and apply patches to prevent potential NULL pointer dereferences.

Recommended defensive actions

  • Review Linux kernel versions for exposure
  • Apply patches or updates from Linux
  • Monitor for potential NULL pointer dereferences
  • Verify Linux kernel versions for exposure
  • Review compensating controls for exposed systems
  • Track exceptions and retest remediated assets
  • debrief

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information on this vulnerability. Supplemental sources include various Linux kernel references. Linux kernel versions and distributions may be affected. Users should verify their exposure and apply patches or updates as necessary. The vulnerability has been resolved in the Linux kernel.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-22991 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-22991

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-22991 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-22991

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • libceph: make free_choose_arg_map() resilient to partial allocation

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22991.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9b3730dabcf3764bfe3ff07caf55e641a0b45234

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/851241d3f78a5505224dc21c03d8692f530256b4

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ec1850f663da64842614c86b20fe734be070c2ba

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8081faaf089db5280c3be820948469f7c58ef8dd

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c4c2152a858c0ce4d2bff6ca8c1d5b0ef9f2cbdf

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f21c3fdb96833aac2f533506899fe38c19cf49d5

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e3fe30e57649c551757a02e1cad073c47e1e075e

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.