Security readout for executives and security teams
Plain-English summary
Linux systems using the kernel’s Ceph client code may read beyond a received authentication payload’s bounds. This could expose memory or destabilize the affected kernel path, but the supplied sources do not demonstrate code execution or confirmed attacks.
Executive priority
Treat as an urgent validation and patching item for Ceph-connected Linux infrastructure because the supplied score is 9.8. Avoid assuming fleet-wide exposure: first confirm libceph use and vendor applicability. Escalate immediately where affected kernels support business-critical storage.
Technical view
libceph handle_auth_done() lacked an explicit payload_len bounds check before a callout, creating a potential out-of-bounds read during authentication handling. The referenced stable-kernel commits add the check. The supplied version metadata is ambiguous, so distribution-specific applicability must be confirmed.
Likely exposure
Exposure requires the affected Linux libceph authentication path, most plausibly on systems using kernel Ceph connectivity. The bundle lists Linux versions including 5.11, 5.15.198, 6.1.161, 6.6.121, 6.12.66, 6.18.6, and 6.19, but does not clearly express version ranges.
Exploitation context
The supplied record is not in KEV and provides no evidence of active exploitation or a public exploit. Its CVSS 3.1 vector rates remote, unauthenticated exploitation as low complexity, but the brief technical description alone does not establish practical exploitability or impact beyond a possible out-of-bounds read.
Researcher notes
The record supplies no CWE and describes only a potential out-of-bounds read, while its CVSS vector claims high confidentiality, integrity, and availability impacts. That mismatch warrants vendor review. Exact affected and fixed ranges are not safely inferable from the flattened version list; use the referenced commits and distribution advisories for mapping.
Mitigation direction
- Identify hosts using the kernel Ceph client or otherwise loading libceph.
- Check each distribution’s advisory and package mapping for CVE-2026-22984.
- Upgrade to a vendor-supported kernel containing the applicable referenced stable fix.
- Prioritize exposed Ceph-connected systems and monitor them until patching is complete.
Validation and detection
- Record running kernel versions and distribution package revisions on Ceph-connected hosts.
- Confirm patched packages incorporate one of the referenced stable-kernel commits.
- Reboot updated systems and verify the patched kernel is running.
- Review kernel logs for Ceph authentication faults, crashes, or unusual memory-related errors.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-22984 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/194cfe2af4d2a1de599d39dad636b47c2f6c2c96CVE reference, Linux
- https://git.kernel.org/stable/c/79fe3511db416d2f2edcfd93569807cb02736e5eCVE reference, Linux
- https://git.kernel.org/stable/c/ef208ea331ef688729f64089b895ed1b49e842e3CVE reference, Linux
- https://git.kernel.org/stable/c/2802ef3380fa8c4a08cda51ec1f085b1a712e9e2CVE reference, Linux
- https://git.kernel.org/stable/c/2d653bb63d598ae4b096dd678744bdcc34ee89e8CVE reference, Linux
- https://git.kernel.org/stable/c/818156caffbf55cb4d368f9c3cac64e458fb49c9CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.