CVE-2026-23136: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23136 is a denial-of-service vulnerability in the Linux kernel's libceph library caused by a failure to reset the sparse-read state machine upon OSD connection faults. When a connection is lost mid-payload, the sparse-read state is not cleared, causing the OSD client to misinterpret the beginning of a new reply as a continuation of the previous one, potentially entering an unrecoverable infinite error loop. Affected versions include Linux kernel 6.6.x (before 6.6.121), 6.7–6.12.x (before 6.12.66), and 6.13–6.18.x (before 6.18.6), as well as 6.19 release candidates up to rc4. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is improper state management (CWE-664) in the osd_fault() function within the Linux kernel's libceph OSD client. The sparse-read state machine, which tracks progress of sparse-read replies independently of the messenger layer, is not reset when a connection fault occurs and is reestablished. Upon reconnection, pending operations are retried, but the stale sparse-read state causes the client to interpret the start of a new reply as a mid-stream continuation, leading to data length mismatches (e.g., data len 142248331 != extent len 0) and repeated socket read errors. The fix involves explicitly resetting the sparse-read state in osd_fault() to ensure retries begin from a clean state (Feedly, Kernel Patch).

Successful exploitation results in a denial-of-service condition affecting availability only — there is no confidentiality or integrity impact. A local attacker with low privileges can trigger OSD connection faults that cause the sparse-read state machine to enter an unrecoverable failure state, producing infinite loops of socket read errors that block Ceph I/O operations. Systems relying on Ceph storage (e.g., cloud infrastructure, distributed storage clusters) would be unable to recover from network interruptions during sparse-read operations without a kernel restart or patch (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of writing. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges, limiting the attack surface to authenticated users on affected systems (Feedly).

• Logs: Repeated kernel log entries matching the pattern libceph: data len <N> != extent len 0 in dmesg or /var/log/kern.log.
• Logs: Recurring messages such as libceph: osd<N> (<IP>):<port> socket error on read appearing in rapid succession without recovery.
• Process/System Behavior: Ceph OSD client I/O operations stalling or hanging indefinitely; applications using Ceph-backed storage becoming unresponsive.
• Network: Repeated TCP connection resets or reconnections to OSD ports (default 6800–7300) from the affected host without successful data transfer.

Apply the appropriate kernel update for your series: upgrade to Linux kernel 6.6.121 or later (6.6 series), 6.12.66 or later (6.7–6.12 series), or 6.18.6 or later (6.13–6.18 series). Vendor-specific updates are available from Red Hat (RHSA-2026:13565, RHSA-2026:19568), SUSE (SUSE-SU-2026:1661-1), Oracle, Rocky Linux (RLSA-2026:13565), AlmaLinux, and Ubuntu. As a temporary workaround for unpatched systems, monitor libceph logs for the error pattern and consider restarting affected OSD services or the host if the infinite loop is observed (Red Hat Advisory, SUSE Advisory, Feedly).