In the Linux kernel, the following vulnerability has been resolved:
libceph: make freechoosearg_map() resilient to partial allocation
freechoosearg_map() may dereference a NULL pointer if its caller fails after a partial allocation.
For example, in decodechooseargs(), if allocation of argmap->args fails, execution jumps to the fail label and freechooseargmap() is called. Since argmap->size is updated to a non-zero value before memory allocation, freechooseargmap() will iterate over arg_map->args and dereference a NULL pointer.
To prevent this potential NULL pointer dereference and make freechoosearg_map() more resilient, add checks for pointers before iterating.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22991.json",
"cna_assigner": "Linux"
}