---
id: CVE-2026-23136
title: 'libceph: reset sparse-read state in osd_fault()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  libceph: reset sparse-read state in osd_fault()

  When a fault occurs, the connection is abandoned, reestablished, and any
  pending operations are retried. The OSD client…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f628d799972799023d32c2542bb2639eb8c4f84e <
    90a60fe61908afa0eaf7f8fcf1421b9b50e5f7ff
  - >-
    Linux >= f628d799972799023d32c2542bb2639eb8c4f84e <
    e94075e950a6598e710b9f7dffea5aa388f40313
  - >-
    Linux >= f628d799972799023d32c2542bb2639eb8c4f84e <
    10b7c72810364226f7b27916ea3e2a4f870bc04b
  - >-
    Linux >= f628d799972799023d32c2542bb2639eb8c4f84e <
    11194b416ef95012c2cfe5f546d71af07b639e93
  - Linux 6.6
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T15:06:32.045794Z'
published: '2026-02-14'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:09:49.563Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23136'
references:
  - url: 'https://git.kernel.org/stable/c/90a60fe61908afa0eaf7f8fcf1421b9b50e5f7ff'
  - url: 'https://git.kernel.org/stable/c/e94075e950a6598e710b9f7dffea5aa388f40313'
  - url: 'https://git.kernel.org/stable/c/10b7c72810364226f7b27916ea3e2a4f870bc04b'
  - url: 'https://git.kernel.org/stable/c/11194b416ef95012c2cfe5f546d71af07b639e93'
tags:
  - cve.org
epss: 0.00328
epssPercentile: 0.24263
ingestedAt: '2026-10-16T17:24:46.639Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

libceph: reset sparse-read state in osd_fault()

When a fault occurs, the connection is abandoned, reestablished, and any
pending operations are retried. The OSD client tracks the progress of a
sparse-read reply using a separate state machine, largely independent of
the messenger's state.

If a connection is lost mid-payload or the sparse-read state machine
returns an error, the sparse-read state is not reset. The OSD client
will then interpret the beginning of a new reply as the continuation of
the old one. If this makes the sparse-read machinery enter a failure
state, it may never recover, producing loops like:

  libceph:  [0] got 0 extents
  libceph: data len 142248331 != extent len 0
  libceph: osd0 (1)...:6801 socket error on read
  libceph: data len 142248331 != extent len 0
  libceph: osd0 (1)...:6801 socket error on read

Therefore, reset the sparse-read state in osd_fault(), ensuring retries
start from a clean state.

## Affected

- `Linux >= f628d799972799023d32c2542bb2639eb8c4f84e < 90a60fe61908afa0eaf7f8fcf1421b9b50e5f7ff`
- `Linux >= f628d799972799023d32c2542bb2639eb8c4f84e < e94075e950a6598e710b9f7dffea5aa388f40313`
- `Linux >= f628d799972799023d32c2542bb2639eb8c4f84e < 10b7c72810364226f7b27916ea3e2a4f870bc04b`
- `Linux >= f628d799972799023d32c2542bb2639eb8c4f84e < 11194b416ef95012c2cfe5f546d71af07b639e93`
- `Linux 6.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.