CVE-2026-22991

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-22991
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-22991.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-22991
Downstream
Related
Published
2026-01-23T15:24:12.191Z
Modified
2026-05-28T03:54:12.973221574Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
libceph: make free_choose_arg_map() resilient to partial allocation
Details

In the Linux kernel, the following vulnerability has been resolved:

libceph: make freechoosearg_map() resilient to partial allocation

freechoosearg_map() may dereference a NULL pointer if its caller fails after a partial allocation.

For example, in decodechooseargs(), if allocation of argmap->args fails, execution jumps to the fail label and freechooseargmap() is called. Since argmap->size is updated to a non-zero value before memory allocation, freechooseargmap() will iterate over arg_map->args and dereference a NULL pointer.

To prevent this potential NULL pointer dereference and make freechoosearg_map() more resilient, add checks for pointers before iterating.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22991.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5cf9c4a9959b6273675310d14a834ef14fbca37c
Fixed
9b3730dabcf3764bfe3ff07caf55e641a0b45234
Fixed
851241d3f78a5505224dc21c03d8692f530256b4
Fixed
ec1850f663da64842614c86b20fe734be070c2ba
Fixed
8081faaf089db5280c3be820948469f7c58ef8dd
Fixed
c4c2152a858c0ce4d2bff6ca8c1d5b0ef9f2cbdf
Fixed
f21c3fdb96833aac2f533506899fe38c19cf49d5
Fixed
e3fe30e57649c551757a02e1cad073c47e1e075e

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-22991.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.13.0
Fixed
5.10.248
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.198
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.161
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.121
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.66
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.6

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-22991.json"