---
id: CVE-2026-22990
title: 'libceph: replace overzealous BUG_ON in osdmap_apply_incremental()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  libceph: replace overzealous BUG_ON in osdmap_apply_incremental()

  If the osdmap is (maliciously) corrupted such that the incremental
  osdmap epoch is different from wha…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f24e9980eb860d8600cbe5ef3d2fd9295320d229 <
    9aa0b0c14cefece078286d78b97d4c09685e372d
  - >-
    Linux >= f24e9980eb860d8600cbe5ef3d2fd9295320d229 <
    4b106fbb1c7b841cd402abd83eb2447164c799ea
  - >-
    Linux >= f24e9980eb860d8600cbe5ef3d2fd9295320d229 <
    6afd2a4213524bc742b709599a3663aeaf77193c
  - >-
    Linux >= f24e9980eb860d8600cbe5ef3d2fd9295320d229 <
    d3613770e2677683e65d062da5e31f48c409abe9
  - >-
    Linux >= f24e9980eb860d8600cbe5ef3d2fd9295320d229 <
    6c6cec3db3b418c4fdf815731bc39e46dff75e1b
  - >-
    Linux >= f24e9980eb860d8600cbe5ef3d2fd9295320d229 <
    6348d70af847b79805374fe628d3809a63fd7df3
  - >-
    Linux >= f24e9980eb860d8600cbe5ef3d2fd9295320d229 <
    e00c3f71b5cf75681dbd74ee3f982a99cb690c2b
  - Linux 2.6.34
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-06-16T20:38:28.126291Z'
published: '2026-01-23'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T18:25:26.297Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-22990'
references:
  - url: 'https://git.kernel.org/stable/c/9aa0b0c14cefece078286d78b97d4c09685e372d'
  - url: 'https://git.kernel.org/stable/c/4b106fbb1c7b841cd402abd83eb2447164c799ea'
  - url: 'https://git.kernel.org/stable/c/6afd2a4213524bc742b709599a3663aeaf77193c'
  - url: 'https://git.kernel.org/stable/c/d3613770e2677683e65d062da5e31f48c409abe9'
  - url: 'https://git.kernel.org/stable/c/6c6cec3db3b418c4fdf815731bc39e46dff75e1b'
  - url: 'https://git.kernel.org/stable/c/6348d70af847b79805374fe628d3809a63fd7df3'
  - url: 'https://git.kernel.org/stable/c/e00c3f71b5cf75681dbd74ee3f982a99cb690c2b'
tags:
  - cve.org
epss: 0.00373
epssPercentile: 0.29816
ingestedAt: '2026-10-19T18:35:50.120Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

libceph: replace overzealous BUG_ON in osdmap_apply_incremental()

If the osdmap is (maliciously) corrupted such that the incremental
osdmap epoch is different from what is expected, there is no need to
BUG.  Instead, just declare the incremental osdmap to be invalid.

## Affected

- `Linux >= f24e9980eb860d8600cbe5ef3d2fd9295320d229 < 9aa0b0c14cefece078286d78b97d4c09685e372d`
- `Linux >= f24e9980eb860d8600cbe5ef3d2fd9295320d229 < 4b106fbb1c7b841cd402abd83eb2447164c799ea`
- `Linux >= f24e9980eb860d8600cbe5ef3d2fd9295320d229 < 6afd2a4213524bc742b709599a3663aeaf77193c`
- `Linux >= f24e9980eb860d8600cbe5ef3d2fd9295320d229 < d3613770e2677683e65d062da5e31f48c409abe9`
- `Linux >= f24e9980eb860d8600cbe5ef3d2fd9295320d229 < 6c6cec3db3b418c4fdf815731bc39e46dff75e1b`
- `Linux >= f24e9980eb860d8600cbe5ef3d2fd9295320d229 < 6348d70af847b79805374fe628d3809a63fd7df3`
- `Linux >= f24e9980eb860d8600cbe5ef3d2fd9295320d229 < e00c3f71b5cf75681dbd74ee3f982a99cb690c2b`
- `Linux 2.6.34`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.