CVE-2026-22991

libceph: make free_choose_arg_map() resilient to partial allocation

State: Published
Severity: 7.5 High
Published: Jan 23, 2026
Updated: Oct 19, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

libceph: make free_choose_arg_map() resilient to partial allocation

free_choose_arg_map() may dereference a NULL pointer if its caller fails after a partial allocation.

For example, in decode_choose_args(), if allocation of arg_map->args fails, execution jumps to the fail label and free_choose_arg_map() is called. Since arg_map->size is updated to a non-zero value before memory allocation, free_choose_arg_map() will iterate over arg_map->args and dereference a NULL pointer.

To prevent this potential NULL pointer dereference and make free_choose_arg_map() more resilient, add checks for pointers before iterating.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	5cf9c4a9959b6273675310d14a834ef14fbca37c to before 9b3730dabcf3764bfe3ff07caf55e641a0b45234Affected 5cf9c4a9959b6273675310d14a834ef14fbca37c to before 851241d3f78a5505224dc21c03d8692f530256b4Affected 5cf9c4a9959b6273675310d14a834ef14fbca37c to before ec1850f663da64842614c86b20fe734be070c2baAffected 5cf9c4a9959b6273675310d14a834ef14fbca37c to before 8081faaf089db5280c3be820948469f7c58ef8ddAffected 5cf9c4a9959b6273675310d14a834ef14fbca37c to before c4c2152a858c0ce4d2bff6ca8c1d5b0ef9f2cbdfAffected 5cf9c4a9959b6273675310d14a834ef14fbca37c to before f21c3fdb96833aac2f533506899fe38c19cf49d5Affected 5cf9c4a9959b6273675310d14a834ef14fbca37c to before e3fe30e57649c551757a02e1cad073c47e1e075eAffected
LinuxLinux	4.13Affected before 4.13Not affected 5.10.248 through 5.10.Not affected 5.15.198 through 5.15.Not affected 6.1.161 through 6.1.Not affected 6.6.121 through 6.6.Not affected 6.12.66 through 6.12.Not affected 6.18.6 through 6.18.Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

5cf9c4a9959b6273675310d14a834ef14fbca37c to before 9b3730dabcf3764bfe3ff07caf55e641a0b45234Affected
5cf9c4a9959b6273675310d14a834ef14fbca37c to before 851241d3f78a5505224dc21c03d8692f530256b4Affected
5cf9c4a9959b6273675310d14a834ef14fbca37c to before ec1850f663da64842614c86b20fe734be070c2baAffected
5cf9c4a9959b6273675310d14a834ef14fbca37c to before 8081faaf089db5280c3be820948469f7c58ef8ddAffected
5cf9c4a9959b6273675310d14a834ef14fbca37c to before c4c2152a858c0ce4d2bff6ca8c1d5b0ef9f2cbdfAffected
5cf9c4a9959b6273675310d14a834ef14fbca37c to before f21c3fdb96833aac2f533506899fe38c19cf49d5Affected
5cf9c4a9959b6273675310d14a834ef14fbca37c to before e3fe30e57649c551757a02e1cad073c47e1e075eAffected

LinuxLinux

4.13Affected
before 4.13Not affected
5.10.248 through 5.10.*Not affected
5.15.198 through 5.15.*Not affected
6.1.161 through 6.1.*Not affected
6.6.121 through 6.6.*Not affected
6.12.66 through 6.12.*Not affected
6.18.6 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.