CVE-2026-22991: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-22991 is a NULL pointer dereference vulnerability in the Linux kernel's libceph component, specifically in the free_choose_arg_map() function. It affects Linux kernel versions 4.13 through 5.10.247, 5.11 through 5.15.197, 5.16 through 6.1.160, 6.2 through 6.6.120, 6.7 through 6.12.65, 6.13 through 6.18.5, and release candidates 6.19-rc1 through rc4. The vulnerability was published on January 23, 2026, with patches released across multiple stable branches. NIST NVD assigns a CVSS v3.1 base score of 5.5 (Medium), while the kernel.org CNA rates it 7.5 (High) (Red Hat Advisory, Feedly).

The root cause is a NULL pointer dereference (CWE-476) in free_choose_arg_map() within the libceph kernel subsystem. During decode_choose_args(), if memory allocation for arg_map->args fails, execution jumps to a fail label and calls free_choose_arg_map(). Because arg_map->size is set to a non-zero value before the allocation attempt, the cleanup function iterates over arg_map->args assuming it is valid — but it is NULL, causing a kernel NULL pointer dereference. The fix adds pointer validity checks before iterating in free_choose_arg_map(). Exploitation requires local access with low privileges, as the attacker must be able to trigger the memory allocation failure path in the kernel (Red Hat Advisory, Feedly).

Successful exploitation results in a kernel crash, causing a denial of service (DoS) condition on the affected system. There is no impact on confidentiality or integrity — only availability is affected, as the NULL pointer dereference causes the kernel to panic or become unstable. Systems running Ceph-connected workloads (using libceph) are particularly at risk, and a crash could disrupt storage access for all users on the affected host (Feedly).

Apply the patched Linux kernel versions for the relevant stable branch: 5.10.248+, 5.15.198+, 6.1.161+, 6.6.121+, 6.12.66+, or 6.18.6+. Patches are available via the Linux kernel stable repositories and have been backported to multiple distributions including Ubuntu (USN-8278-1, USN-8289-1, USN-8296-1) and Amazon Linux 2. As a compensating control, restrict local system access to trusted users only and monitor for unexpected kernel crashes or panics that may indicate exploitation attempts. No configuration-based workaround is available; upgrading to a patched kernel is the only definitive remediation (Feedly, Red Hat Advisory).