CVE-2026-23136

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

libceph: reset sparse-read state in osd_fault()

When a fault occurs, the connection is abandoned, reestablished, and any

pending operations are retried. The OSD client tracks the progress of a

sparse-read reply using a separate state machine, largely independent of

the messenger's state.

If a connection is lost mid-payload or the sparse-read state machine

returns an error, the sparse-read state is not reset. The OSD client

will then interpret the beginning of a new reply as the continuation of

the old one. If this makes the sparse-read machinery enter a failure

state, it may never recover, producing loops like:

libceph: [0] got 0 extents

libceph: data len 142248331 != extent len 0

libceph: osd0 (1)...:6801 socket error on read

libceph: data len 142248331 != extent len 0

libceph: osd0 (1)...:6801 socket error on read

Therefore, reset the sparse-read state in osd_fault(), ensuring retries

start from a cle

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References