Log in Start free

Vulnerability · Published Jan 23, 2026 · Assigned by Linux

CVE-2026-22991libceph: make free_choose_arg_map() resilient to partial allocation

High 7.5

In plain English

A high-severity null pointer dereference in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 59.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: libceph: make free_choose_arg_map() resilient to partial allocation free_choose_arg_map() may dereference a NULL pointer if its caller fails after a partial allocation. For example, in decode_choose_args(), if allocation of arg_map->args fails, execution jumps to the fail label and free_choose_arg_map() is called. Since arg_map->size is updated to a non-zero value before memory allocation, free_choose_arg_map() will iterate over arg_map->args and dereference a NULL pointer. To prevent this potential NULL pointer dereference and make free_choose_arg_map() more resilient, add checks for pointers before iterating.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.162-1DEBIAN-CVE-2026-22991
Debian:13linux6.12.69-1DEBIAN-CVE-2026-22991
Debian:14linux6.18.8-1DEBIAN-CVE-2026-22991
Ubuntu:22.04:LTSlinux5.15.0-173.183UBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux6.8.0-117.117UBUNTU-CVE-2026-22991
Ubuntu:25.10linuxno fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-aws5.15.0-1103.110UBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-aws6.8.0-1055.58UBUNTU-CVE-2026-22991
Ubuntu:25.10linux-awsno fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-aws-6.14no fix listedUBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-aws-6.17no fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1057.60~22.04.1UBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-azure5.15.0-1109.118UBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-azure6.8.0-1056.62UBUNTU-CVE-2026-22991
Ubuntu:25.10linux-azureno fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-azure-6.14no fix listedUBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-azure-6.176.17.0-1021.21~24.04.1UBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-azure-6.176.17.0-1021.21~24.04.1USN-8604-1
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1059.65~22.04.1UBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1109.118.1UBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-azure-fde6.8.0-1058.65UBUNTU-CVE-2026-22991
Ubuntu:25.10linux-azure-fdeno fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-azure-fde-6.14no fix listedUBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-azure-fde-6.176.17.0-1018.18~24.04.1USN-8605-1
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-azure-fde-6.86.8.0-1058.65~22.04.1UBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-azure-nvidiano fix listedUBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-azure-nvidia-6.14no fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-gcp5.15.0-1103.112UBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-gcp6.8.0-1058.61UBUNTU-CVE-2026-22991
Ubuntu:25.10linux-gcpno fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-gcp-6.14no fix listedUBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-gcp-6.176.17.0-1021.24~24.04.1USN-8570-1
Ubuntu:24.04:LTSlinux-gcp-6.176.17.0-1021.24~24.04.1UBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1060.63~22.04.1UBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-gke5.15.0-1099.105UBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-gke6.8.0-1054.60UBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1086.94UBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1041.44UBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-hwe-6.14no fix listedUBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-hwe-6.176.17.0-41.41~24.04.1UBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-124.124~22.04.1UBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-ibm5.15.0-1097.100UBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-ibm6.8.0-1055.56UBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1055.56~22.04.1UBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1098.104UBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-kvm5.15.0-1095.100UBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-173.183UBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-117.117.1UBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-117.117.1~22.04.1UBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1098.99UBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1054.57UBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-nvidia-6.176.17.0-1031.31USN-8669-1
Ubuntu:24.04:LTSlinux-nvidia-6.176.17.0-1031.31UBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1054.57~22.04.1UBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1054.57.1UBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1055.55UBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-nvidia-tegra6.8.0-1024.24UBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1044.44UBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-oem-6.14no fix listedUBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-oem-6.176.17.0-1030.30UBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-oem-6.176.17.0-1030.30USN-8594-1
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-oracle5.15.0-1100.106UBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-oracle6.8.0-1054.55UBUNTU-CVE-2026-22991
Ubuntu:25.10linux-oracleno fix listedUBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-oracle-6.14no fix listedUBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-oracle-6.176.17.0-1019.19~24.04.3USN-8570-2
Ubuntu:24.04:LTSlinux-oracle-6.176.17.0-1019.19~24.04.3UBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1054.55~22.04.1UBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-raspi5.15.0-1097.100UBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-raspi6.8.0-1056.60UBUNTU-CVE-2026-22991
Ubuntu:25.10linux-raspino fix listedUBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-22991
Ubuntu:25.10linux-realtimeno fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-22991
Ubuntu:25.10linux-riscvno fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-riscv-6.17no fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-117.117~22.04.1UBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2026-22991
Ubuntu:24.04:LTSlinux-xilinx6.8.0-1032.33UBUNTU-CVE-2026-22991
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1067.71UBUNTU-CVE-2026-22991

Affected products (as reported)

VendorProductVersions
Linux Linux 5cf9c4a9959b6273675310d14a834ef14fbca37c – before 9b3730dabcf3764bfe3ff07caf55e641a0b452345cf9c4a9959b6273675310d14a834ef14fbca37c – before 851241d3f78a5505224dc21c03d8692f530256b45cf9c4a9959b6273675310d14a834ef14fbca37c – before ec1850f663da64842614c86b20fe734be070c2ba5cf9c4a9959b6273675310d14a834ef14fbca37c – before 8081faaf089db5280c3be820948469f7c58ef8dd5cf9c4a9959b6273675310d14a834ef14fbca37c – before c4c2152a858c0ce4d2bff6ca8c1d5b0ef9f2cbdf5cf9c4a9959b6273675310d14a834ef14fbca37c – before f21c3fdb96833aac2f533506899fe38c19cf49d55cf9c4a9959b6273675310d14a834ef14fbca37c – before e3fe30e57649c551757a02e1cad073c47e1e075e
Linux Linux 4.13

Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References