AZL-78470
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-78470.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-78470
- Upstream
- Published
- 2026-01-23T16:15:55Z
- Modified
- 2026-04-01T05:23:15Z
- Summary
- CVE-2026-22991 affecting package kernel for versions less than 5.15.200.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
libceph: make free_choose_arg_map() resilient to partial allocation
free_choose_arg_map() may dereference a NULL pointer if its caller fails after a partial allocation.
For example, in decode_choose_args(), if allocation of arg_map->args fails, execution jumps to the fail label and free_choose_arg_map() is called. Since arg_map->size is updated to a non-zero value before memory allocation, free_choose_arg_map() will iterate over arg_map->args and dereference a NULL pointer.
To prevent this potential NULL pointer dereference and make free_choose_arg_map() more resilient, add checks for pointers before iterating.
- References