CVE-2026-22990: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-22990 is a denial-of-service vulnerability in the Linux kernel's libceph component, caused by an overzealous BUG_ON assertion in the osdmap_apply_incremental() function. When a maliciously or accidentally corrupted incremental osdmap is received with an unexpected epoch value, the kernel triggers a panic instead of gracefully handling the error. The vulnerability affects Linux kernel versions from 2.6.34 through multiple stable branches, with fixed versions including 5.10.248, 5.15.198, 6.1.161, 6.6.121, 6.12.66, and 6.18.6. It was published on January 23, 2026. NIST NVD assigns a CVSS v3.1 score of 5.5 (Medium) under a local attack vector, while kernel.org's CNA rates it 7.5 (High) reflecting a network-reachable attack vector (Red Hat Advisory, kernel.org patches).

The root cause is a reachable assertion (CWE-617): the osdmap_apply_incremental() function in libceph unconditionally calls BUG_ON when the epoch of an incoming incremental osdmap does not match the expected value, causing an immediate kernel panic. An attacker who can deliver a crafted or corrupted osdmap incremental update — for example, by compromising a Ceph monitor or injecting malicious data on the network path — can trigger this condition. The fix replaces the BUG_ON with proper validation logic that declares the incremental osdmap invalid and returns an error without crashing the kernel. Multiple stable-branch patches were issued across kernel versions (kernel.org patches, Red Hat Advisory).

Successful exploitation results in a kernel panic (system crash), causing a complete denial of service on the affected host. Any system running a vulnerable Linux kernel version with the Ceph distributed storage client (libceph) active is at risk, including nodes in Ceph storage clusters. There is no confidentiality or integrity impact; the sole consequence is availability loss, which can disrupt storage services and any workloads dependent on the affected node (Red Hat Advisory, Feedly).

Update the Linux kernel to a patched version that resolves the osdmap_apply_incremental() issue. Fixed versions include: 5.10.248, 5.15.198, 6.1.161, 6.6.121, 6.12.66, and 6.18.6 (kernel.org patches). Vendor-specific updates are available from Red Hat (RHSA-2026:19568, RHSA-2026:25121), Ubuntu (USN-8278-1, USN-8289-1, USN-8296-1), SUSE (SUSE-SU-2026:1668-1), Amazon Linux 2, Oracle Linux, and Microsoft (CBL-Mariner) (Red Hat Errata, Ubuntu USN-8278-1, SUSE Advisory). As a network-level workaround, restrict access to Ceph monitor and OSD traffic to trusted hosts only, reducing the attack surface for delivering malicious osdmap updates.