CVE-2026-22992: Linux Kernel Privilege Escalation Flaw

CVE-2026-22992 Overview

CVE-2026-22992 is a Linux kernel vulnerability in the libceph subsystem. The mon_handle_auth_done() function fails to return errors propagated from ceph_auth_handle_reply_done(). Higher layers learn authentication failed, but the msgr2 messenger still attempts to establish the session in the background. In secure mode this triggers a WARN inside setup_crypto() and later causes a NULL pointer dereference in prepare_auth_signature(). The flaw is classified as [CWE-476] (NULL Pointer Dereference) and primarily affects system availability through kernel-level crashes.

Critical Impact
A local low-privileged user interacting with a Ceph cluster in secure mode can trigger a kernel NULL pointer dereference, causing a denial of service.

Affected Products

Linux Kernel (multiple stable branches prior to fix commits)
Linux Kernel 6.19-rc1, 6.19-rc2, 6.19-rc3, 6.19-rc4
Systems using libceph with msgr2 secure-mode authentication

Discovery Timeline

2026-01-23 - CVE-2026-22992 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-22992

Vulnerability Analysis

The vulnerability resides in the Ceph distributed storage client integrated into the Linux kernel. The function mon_handle_auth_done() processes the authentication-done message from a Ceph monitor. When ceph_auth_handle_reply_done() reports an error, that error is propagated through finish_auth() but never returned by mon_handle_auth_done() itself.

As a result, the monitor connection state machine treats authentication as successful while upper layers correctly recognize a failure. The mismatch leaves the msgr2 (messenger version 2) protocol attempting to continue session establishment despite an inconsistent authentication state.

In secure mode, the msgr2 path proceeds into setup_crypto(), which triggers a WARN because cryptographic state was not properly negotiated. Execution continues until prepare_auth_signature() dereferences a NULL pointer, crashing the kernel.

Root Cause

The root cause is a missing error-return path in mon_handle_auth_done(). The function discards the handler error code from ceph_auth_handle_reply_done(), breaking the contract that callers rely on to abort session establishment when authentication fails.

Attack Vector

The attack vector is local. An authenticated low-privileged user must interact with a Ceph cluster configured in secure mode, or a misbehaving or malicious Ceph monitor must return a crafted authentication reply. Successful triggering of the flaw produces a kernel WARN followed by a NULL pointer dereference, resulting in a denial-of-service condition on the affected host. No confidentiality or integrity impact is identified.

No public proof-of-concept exploit is available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog and has an EPSS score of 0.054%.

Detection Methods for CVE-2026-22992

Indicators of Compromise

Kernel WARN entries originating from setup_crypto() in the libceph module
Kernel oops or panic traces referencing prepare_auth_signature() and NULL pointer dereferences
Repeated Ceph monitor authentication failures followed by client disconnects on msgr2 secure connections

Detection Strategies

Monitor dmesg and /var/log/kern.log for stack traces involving libceph, mon_handle_auth_done, setup_crypto, or prepare_auth_signature
Correlate Ceph monitor authentication errors with subsequent kernel crash events on the same host
Audit installed kernel versions against the fixed commits listed in the upstream git.kernel.org advisories

Monitoring Recommendations

Ingest kernel logs from Ceph client nodes into a centralized logging or SIEM platform for alerting on libceph warnings and oops events
Track host uptime and unexpected reboots on systems mounting CephFS or attaching RBD volumes
Alert on repeated msgr2 secure-mode authentication failures that precede kernel instability

How to Mitigate CVE-2026-22992

Immediate Actions Required

Apply the upstream Linux kernel patches that propagate the handler error from mon_handle_auth_done() and reboot affected hosts
Inventory all systems using libceph, ceph.ko, rbd.ko, or CephFS mounts and prioritize patching kernels in the affected ranges
Restrict local access on Ceph client nodes to trusted operators until patches are deployed

Patch Information

The fix has been merged into stable Linux kernel branches. Reference the upstream commits:

Obtain the corresponding kernel update from your Linux distribution and validate the fix is present in your running kernel after reboot.

Workarounds

Avoid msgr2 secure-mode connections to Ceph monitors until patched kernels are deployed, falling back to a non-secure transport if operationally acceptable
Limit which users can mount CephFS or map RBD images on unpatched hosts to reduce exposure to crash conditions
Ensure Ceph monitor infrastructure is hardened and access-controlled to prevent untrusted parties from returning crafted authentication replies

bash

# Verify running kernel version and check for fix
uname -r

# On Debian/Ubuntu, update kernel package
sudo apt update && sudo apt upgrade linux-image-generic

# On RHEL/CentOS/Rocky
sudo dnf update kernel

# Reboot to load patched kernel
sudo systemctl reboot