CVE-2026-23136
Linux Kernel 6.6 – 6.6.121
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-23136 is a high-severity Improper Locking (CWE-667) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 15th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-23136 is a vulnerability in the Linux kernel's libceph module, which handles Ceph distributed storage interactions. The issue arises in the osd_fault() function during fault recovery: when a connection is lost mid-payload or the sparse-read state machine errors out, the sparse-read state is not reset. This causes the OSD client to misinterpret the start of a new reply as a continuation of the previous one, potentially driving the sparse-read machinery into a permanent failure state and producing infinite error loops, such as repeated mismatches between data lengths and extent lengths followed by socket read errors.
A remote network attacker with no privileges or user interaction can exploit this vulnerability with low complexity, as indicated by its CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Exploitation involves triggering a connection fault during a sparse-read operation, causing the affected system to enter non-recoverable loops that consume resources and deny availability of Ceph OSD client functionality.
The provided kernel stable commit references detail the fix: patches to osd_fault() explicitly reset the sparse-read state upon faults, ensuring pending operations retry from a clean state and preventing the observed loops. Systems should apply these upstream patches from the linked git commits to mitigate the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5901
Vulnerability Data
In the Linux kernel, the following vulnerability has been resolved: libceph: reset sparse-read state in osd_fault() When a fault occurs, the connection is abandoned, reestablished, and any pending operations are retried. The OSD client tracks the progress of a sparse-read…
more
reply using a separate state machine, largely independent of the messenger's state. If a connection is lost mid-payload or the sparse-read state machine returns an error, the sparse-read state is not reset. The OSD client will then interpret the beginning of a new reply as the continuation of the old one. If this makes the sparse-read machinery enter a failure state, it may never recover, producing loops like: libceph: [0] got 0 extents libceph: data len 142248331 != extent len 0 libceph: osd0 (1)...:6801 socket error on read libceph: data len 142248331 != extent len 0 libceph: osd0 (1)...:6801 socket error on read Therefore, reset the sparse-read state in osd_fault(), ensuring retries start from a clean state.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect race conditions and locking errors before release.
Secure coding standards directly prohibit missing or incorrect lock usage.
Change management may catch locking issues introduced by modifications but does not prevent the weakness itself.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-667, a class-level weakness, and none of its children carries one either.