LiveActive security incident?Get immediate response
CVE Record

CVE-2026-22992: libceph: return the handler error from mon_handle_auth_done()

In the Linux kernel, the following vulnerability has been resolved: libceph: return the handler error from mon_handle_auth_done() Currently any error from ceph_auth_handle_reply_done() is propagated via finish_auth() but isn't returned from mon_handle_auth_done(). This results in higher layers learning that (despite the monitor considering us to be successfully authenticated) something went wrong in the authentication phase and reacting accordingly, but msgr2 still trying to proceed with establishing the session in the background. In the case of secure mode this can trigger a WARN in setup_crypto() and later lead to a NULL pointer dereference inside of prepare_auth_signature().

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux Ceph authentication error can leave session setup running after authentication has already failed. In secure mode, this may crash the kernel through a NULL pointer dereference, disrupting storage clients or dependent services. The supplied CVSS score is 7.5, reflecting network-reachable availability impact without stated confidentiality or integrity loss.

Executive priority

Treat this as a prompt availability remediation for Ceph-backed production services. Accelerate patching where storage interruption would affect critical operations or where Ceph monitor traffic crosses untrusted networks. Routine scheduling may be appropriate for systems proven not to use libceph.

Technical view

mon_handle_auth_done() failed to return errors from ceph_auth_handle_reply_done(). Higher layers detected failure, while Ceph msgr2 continued session establishment. In secure mode, this inconsistent state can trigger a setup_crypto() warning and a NULL pointer dereference in prepare_auth_signature(). Stable-kernel commits correct the error propagation.

Likely exposure

Exposure is limited to Linux systems using the kernel libceph client, particularly Ceph msgr2 secure-mode connections. The supplied affected-version data spans Linux 5.11 through 6.19 but is ambiguous about fixed boundaries; confirm downstream kernel backports and package status with each vendor.

Exploitation context

The CVSS vector describes network-reachable, low-complexity, unauthenticated availability impact. However, the bundle provides no reproduction details or evidence of active exploitation, and the CVE is not listed as KEV. Exact attacker-controlled prerequisites are not established by the supplied sources.

Researcher notes

No CWE is supplied. The listed affected versions and repeated commit identifier do not clearly define every vulnerable or fixed release, so package-level verification is essential. The source bundle supports a denial-of-service outcome through kernel NULL dereference, but not data disclosure, modification, active exploitation, or a complete threat model.

Mitigation direction

  • Install a vendor-supported kernel update containing the applicable stable-kernel fix.
  • Confirm downstream distribution advisories because kernel fixes are frequently backported without matching upstream version numbers.
  • Prioritize Ceph systems using msgr2 secure mode and supporting availability-sensitive workloads.
  • Review Siemens SSA-019113 for affected Siemens products and vendor-specific remediation guidance.

Validation and detection

  • Inventory kernel versions and identify systems loading or using libceph.
  • Check kernel package changelogs for CVE-2026-22992 or the referenced upstream fix.
  • Confirm Ceph connections use msgr2 secure mode where applicable.
  • Review kernel logs for setup_crypto warnings, Ceph authentication failures, NULL dereferences, or related crashes.
  • In controlled testing, verify session establishment stops cleanly after authentication-handler errors.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-22992 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
8Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: yesTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2026-22992Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxcd1a677cad994021b19665ed476aea63f5d54f31, cd1a677cad994021b19665ed476aea63f5d54f31, cd1a677cad994021b19665ed476aea63f5d54f31, cd1a677cad994021b19665ed476aea63f5d54f31, cd1a677cad994021b19665ed476aea63f5d54f31, cd1a677cad994021b19665ed476aea63f5d54f31unaffected
LinuxLinux5.11, 0, 5.15.198, 6.1.161, 6.6.121, 6.12.66, 6.18.6, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.