Security readout for executives and security teams
Plain-English summary
A Linux kernel component used with Ceph can react to a specially corrupted storage-cluster map by hitting a fatal safety check instead of rejecting the map. The stated impact is service availability, not data theft or modification. Systems actively using libceph deserve prompt review; ordinary Linux hosts may not expose the vulnerable path.
Executive priority
Use an accelerated patch cycle for production systems that depend on libceph, especially where storage disruption would affect critical services. Confirm exposure before escalating unaffected Linux fleets. The supplied evidence supports high availability risk but does not support emergency incident response based on known exploitation.
Technical view
libceph's osdmap_apply_incremental() used BUG_ON when an incremental OSD map epoch differed from the expected value. Malformed or maliciously corrupted cluster metadata could therefore cause high availability impact. The resolution treats the incremental map as invalid instead. CVSS 3.1 is 7.5: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Likely exposure
Exposure is most plausible on affected Linux systems where libceph actively processes Ceph OSD maps. Hosts not using libceph are unlikely to reach this code path. The supplied version list is ambiguous and includes historical releases plus apparent boundary values, so distributions and backports must be checked through vendor advisories.
Exploitation context
The bundle marks KEV false and provides no evidence of active exploitation or a public exploit. The described scenario requires a maliciously corrupted incremental OSD map with an unexpected epoch. CVSS classifies the issue as network-accessible, low-complexity, and requiring no privileges or user interaction, but the sources do not document practical attack prerequisites or observed incidents.
Researcher notes
The bundle repeats one Git identifier and lists release numbers without explicit range operators, so exact affected and fixed boundaries cannot be reconstructed safely. The seven kernel stable links appear to represent resolution commits across branches. Map distribution backports and package builds rather than relying solely on upstream version-string comparisons.
Mitigation direction
- Identify Linux systems using libceph and connected to Ceph infrastructure.
- Consult Linux distribution or Ceph vendor advisories to map affected packages and supported updates.
- Install a vendor-supported kernel containing the applicable cited stable fix.
- Prioritize availability-critical Ceph clients; use vendor-recommended compensating controls if patching is delayed.
Validation and detection
- Record the running kernel package and confirm whether libceph is loaded or actively used.
- Map the package build to vendor advisories or verify inclusion of the applicable stable fix.
- After updating, confirm the fixed kernel is active on every targeted host.
- Monitor for kernel BUG events referencing osdmap_apply_incremental() and investigate any recurrence.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-22990 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9aa0b0c14cefece078286d78b97d4c09685e372dCVE reference, Linux
- https://git.kernel.org/stable/c/4b106fbb1c7b841cd402abd83eb2447164c799eaCVE reference, Linux
- https://git.kernel.org/stable/c/6afd2a4213524bc742b709599a3663aeaf77193cCVE reference, Linux
- https://git.kernel.org/stable/c/d3613770e2677683e65d062da5e31f48c409abe9CVE reference, Linux
- https://git.kernel.org/stable/c/6c6cec3db3b418c4fdf815731bc39e46dff75e1bCVE reference, Linux
- https://git.kernel.org/stable/c/6348d70af847b79805374fe628d3809a63fd7df3CVE reference, Linux
- https://git.kernel.org/stable/c/e00c3f71b5cf75681dbd74ee3f982a99cb690c2bCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.