---
id: CVE-2026-22991
title: 'libceph: make free_choose_arg_map() resilient to partial allocation'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  libceph: make free_choose_arg_map() resilient to partial allocation

  free_choose_arg_map() may dereference a NULL pointer if its caller fails
  after a partial allocation…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5cf9c4a9959b6273675310d14a834ef14fbca37c <
    9b3730dabcf3764bfe3ff07caf55e641a0b45234
  - >-
    Linux >= 5cf9c4a9959b6273675310d14a834ef14fbca37c <
    851241d3f78a5505224dc21c03d8692f530256b4
  - >-
    Linux >= 5cf9c4a9959b6273675310d14a834ef14fbca37c <
    ec1850f663da64842614c86b20fe734be070c2ba
  - >-
    Linux >= 5cf9c4a9959b6273675310d14a834ef14fbca37c <
    8081faaf089db5280c3be820948469f7c58ef8dd
  - >-
    Linux >= 5cf9c4a9959b6273675310d14a834ef14fbca37c <
    c4c2152a858c0ce4d2bff6ca8c1d5b0ef9f2cbdf
  - >-
    Linux >= 5cf9c4a9959b6273675310d14a834ef14fbca37c <
    f21c3fdb96833aac2f533506899fe38c19cf49d5
  - >-
    Linux >= 5cf9c4a9959b6273675310d14a834ef14fbca37c <
    e3fe30e57649c551757a02e1cad073c47e1e075e
  - Linux 4.13
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-06-16T20:35:31.087945Z'
published: '2026-01-23'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T18:25:26.442Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-22991'
references:
  - url: 'https://git.kernel.org/stable/c/9b3730dabcf3764bfe3ff07caf55e641a0b45234'
  - url: 'https://git.kernel.org/stable/c/851241d3f78a5505224dc21c03d8692f530256b4'
  - url: 'https://git.kernel.org/stable/c/ec1850f663da64842614c86b20fe734be070c2ba'
  - url: 'https://git.kernel.org/stable/c/8081faaf089db5280c3be820948469f7c58ef8dd'
  - url: 'https://git.kernel.org/stable/c/c4c2152a858c0ce4d2bff6ca8c1d5b0ef9f2cbdf'
  - url: 'https://git.kernel.org/stable/c/f21c3fdb96833aac2f533506899fe38c19cf49d5'
  - url: 'https://git.kernel.org/stable/c/e3fe30e57649c551757a02e1cad073c47e1e075e'
tags:
  - cve.org
epss: 0.00433
epssPercentile: 0.36265
ingestedAt: '2026-10-19T18:35:50.112Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

libceph: make free_choose_arg_map() resilient to partial allocation

free_choose_arg_map() may dereference a NULL pointer if its caller fails
after a partial allocation.

For example, in decode_choose_args(), if allocation of arg_map->args
fails, execution jumps to the fail label and free_choose_arg_map() is
called. Since arg_map->size is updated to a non-zero value before memory
allocation, free_choose_arg_map() will iterate over arg_map->args and
dereference a NULL pointer.

To prevent this potential NULL pointer dereference and make
free_choose_arg_map() more resilient, add checks for pointers before
iterating.

## Affected

- `Linux >= 5cf9c4a9959b6273675310d14a834ef14fbca37c < 9b3730dabcf3764bfe3ff07caf55e641a0b45234`
- `Linux >= 5cf9c4a9959b6273675310d14a834ef14fbca37c < 851241d3f78a5505224dc21c03d8692f530256b4`
- `Linux >= 5cf9c4a9959b6273675310d14a834ef14fbca37c < ec1850f663da64842614c86b20fe734be070c2ba`
- `Linux >= 5cf9c4a9959b6273675310d14a834ef14fbca37c < 8081faaf089db5280c3be820948469f7c58ef8dd`
- `Linux >= 5cf9c4a9959b6273675310d14a834ef14fbca37c < c4c2152a858c0ce4d2bff6ca8c1d5b0ef9f2cbdf`
- `Linux >= 5cf9c4a9959b6273675310d14a834ef14fbca37c < f21c3fdb96833aac2f533506899fe38c19cf49d5`
- `Linux >= 5cf9c4a9959b6273675310d14a834ef14fbca37c < e3fe30e57649c551757a02e1cad073c47e1e075e`
- `Linux 4.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.