CVE-2026-23136

Root

Cause

The vulnerability resides in the Linux kernel's Ceph OSD (Object Storage Daemon) client library (libceph). When an OSD connection encounters a fault, the connection is abandoned and reestablished while pending operations are retried. The sparse-read reply state machine—used to handle partial read responses—is maintained independently of the messenger's connection state. The fault handling code in osd_fault() did not reset this sparse-read state, causing it to retain its old, possibly intermediate or error state across reconnections.

##[1]()? This oversight means that after a fault, a new reply may be mis‑interpreted as a continuation of the previous, incomplete reply.

Attack

Vector

The vulnerability can be triggered by an attacker who is able to induce a connection fault between a client and a Ceph OSD while a sparse read is in progress—for example by causing a network disruption or a malicious OSD that terminates the TCP connection mid‑payload. No authentication is required beyond normal Ceph network access. The attack is entirely network‑based and does not require any local privileges on the client machine.

Impact

Successful exploitation leads to an infinite loop where the sparse‑read engine repeatedly fails with log messages such as "got 0 extents" and "data len 142248331 != extent len 0", and each failure triggers another socket error, thus exhausting CPU resources and effectively causing a denial‑of‑service (DoS) condition on the affected client system. The high severity is justified by the DoS impact and the fact that the loop can prevent the client from making further progress on any OSD operations.

Mitigation

This issue has been patched in the Linux kernel stable update that includes commit 10b7c7281036 and related backport commits (references [1] and [2]). All Linux kernel users running Ceph clients are advised to update to a kernel version containing the fix. No workaround is known other than applying the patch or avoiding network conditions that cause OSD faults during sparse reads.