CVE-2026-22992: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-22992 is a NULL pointer dereference vulnerability in the Linux kernel's libceph authentication handler, specifically in the mon_handle_auth_done() function. Errors returned by ceph_auth_handle_reply_done() are propagated via finish_auth() but not returned from mon_handle_auth_done(), causing a state mismatch where higher layers abort authentication while the msgr2 layer continues establishing a session in the background. In secure mode, this can trigger a kernel warning in setup_crypto() and subsequently a NULL pointer dereference in prepare_auth_signature(). Affected Linux kernel versions span 5.11 through 5.15.197, 5.16 through 6.1.160, 6.2 through 6.6.120, 6.7 through 6.12.65, and 6.13 through 6.18.5. The vulnerability was published on January 23, 2026, with a CVSS v3.1 base score of 5.5 (Medium) per NIST NVD, and 7.5 (High) per kernel.org CNA (Feedly, NVD).

The root cause is improper error handling (CWE-476: NULL Pointer Dereference) in the libceph subsystem of the Linux kernel. When ceph_auth_handle_reply_done() returns an error during Ceph monitor authentication, mon_handle_auth_done() fails to propagate that error code to its caller. As a result, the msgr2 messaging layer continues attempting to establish a secure session despite the authentication failure, eventually calling prepare_auth_signature() with an uninitialized or NULL crypto context set up by setup_crypto(). The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction, making it exploitable by any authenticated local user on a system using Ceph storage with msgr2 in secure mode (Feedly, NVD).

Successful exploitation results in a kernel NULL pointer dereference, causing a system crash and denial of service (availability impact: High). There is no confidentiality or integrity impact. The vulnerability primarily affects systems running Ceph storage infrastructure that use the msgr2 protocol in secure mode, such as Ceph OSD nodes, monitor nodes, or clients with libceph loaded. A local attacker with low privileges could crash the kernel, disrupting all services on the affected host and potentially impacting Ceph cluster availability (Feedly).

• Logs: Kernel warning messages referencing setup_crypto() in the kernel log (e.g., dmesg or /var/log/kern.log); kernel oops or BUG messages referencing prepare_auth_signature() or libceph/msgr2 subsystems.
• System Behavior: Unexpected kernel panics or system reboots on hosts running Ceph clients or servers using msgr2 in secure mode; Ceph authentication failures followed by system instability.
• Process: Ceph-related processes (e.g., ceph-osd, ceph-mon, ceph-mds) crashing or becoming unresponsive around the time of authentication events.

Kernel patches have been released across all affected stable branches. Users should upgrade to one of the following fixed versions: Linux kernel 5.15.198 or later, 6.1.161 or later, 6.6.121 or later, 6.12.66 or later, or 6.18.6 or later (Feedly, NVD). Specific upstream patch commits are available in the stable kernel repositories. As a temporary workaround where patching is not immediately possible, consider restricting local user access on systems running Ceph with msgr2 in secure mode, or disabling secure mode in msgr2 if operationally acceptable. Ubuntu security notices USN-8278-1, USN-8289-1, USN-8296-1, USN-8278-2, USN-8296-2, and USN-8393-1 address this issue for Ubuntu users (Feedly). Amazon Linux 2 users should refer to ALAS2KERNEL-5.15-2026-098.

Red Hat tracked this vulnerability and assigned a CVSS score via their advisory process (Red Hat CVE). Microsoft also acknowledged the vulnerability in their security guidance portal for CBL-Mariner (Azure Linux) (Microsoft MSRC). Oracle Linux issued an advisory (ELSA-2026-50144) addressing the issue. The Yocto Project security mailing list discussed the vulnerability in the context of embedded Linux distributions. No significant social media discussion or notable researcher commentary beyond standard vulnerability tracking has been observed.