CVE-2026-22990

In the Linux kernel, the following vulnerability has been resolved:

libceph: replace overzealous BUG_ON in osdmap_apply_incremental()

If the osdmap is (maliciously) corrupted such that the incremental osdmap epoch is different from what is expected, there is no need to BUG. Instead, just declare the incremental osdmap to be invalid.

This is a reachable kernel BUG triggered by malformed (or maliciously corrupted) Ceph incremental OSD map data: an unexpected epoch value could hit a BUG_ON() and panic the kernel. The trigger is received over the Ceph protocol in established Ceph sessions (i.e., within the trusted/authorized cluster communication model), but it breaks that model by allowing a peer to cause a hard host crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If Ceph not being used, then possible to disable it. To mitigate this issue, prevent module libceph from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.