CVE-2026-22991
BaseFortify
Publication date: 2026-01-23
Last updated on: 2026-04-27
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.11 (inc) to 5.15.198 (exc) |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.6 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.121 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.66 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.161 (exc) |
| linux | linux_kernel | From 4.13 (inc) to 5.10.248 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version where the free_choose_arg_map() function has been fixed to include pointer checks before dereferencing. Applying the latest kernel patches that address this issue will prevent potential NULL pointer dereferences.
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's libceph component where the function free_choose_arg_map() may dereference a NULL pointer if its caller fails after a partial memory allocation. Specifically, if allocation of arg_map->args fails in decode_choose_args(), free_choose_arg_map() is called with arg_map->size already set to a non-zero value, causing it to iterate over a NULL pointer, leading to a potential NULL pointer dereference. The fix involves adding pointer checks before iteration to prevent this issue.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to dereference a NULL pointer, which may lead to kernel crashes or system instability. Such crashes could result in denial of service or unexpected behavior in systems using the affected libceph component.