CVE-2026-22991 Details

A vulnerability in the Linux kernel's libceph component can lead to a NULL pointer dereference. This issue occurs in the free_choose_arg_map() function, which can be called after a partial allocation failure, particularly in the decode_choose_args() function. When the allocation of arg_map->args fails, the function free_choose_arg_map() is invoked. However, since arg_map->size is updated to a non-zero value before the memory allocation, the free_choose_arg_map() function will attempt to iterate over arg_map->args and dereference a NULL pointer. This vulnerability has been addressed by adding checks for NULL pointers before iteration, ensuring that free_choose_arg_map() can safely handle cases of partial allocation.

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for upgrading the Linux kernel can be found in the official Linux kernel documentation.