Answer in brief
CVE-2026-23136 records a High severity (CVSS 7.5) vulnerability in libceph: reset sparse-read state in osd_fault(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=f628d799972799023d32c2542bb2639eb8c4f84e <90a60fe61908afa0eaf7f8fcf1421b9b50e5f7ff || >=f628d799972799023d32c2542bb2639eb8c4f84e <e94075e950a6598e710b9f7dffea5aa388f40313 || >=f628d799972799023d32c2542bb2639eb8c4f84e <10b7c72810364226f7b27916ea3e2a4f870bc04b || >=f628d799972799023d32c2542bb2639eb8c4f84e <11194b416ef95012c2cfe5f546d71af07b639e93 | 90a60fe61908afa0eaf7f8fcf1421b9b50e5f7ff, e94075e950a6598e710b9f7dffea5aa388f40313, 10b7c72810364226f7b27916ea3e2a4f870bc04b, 11194b416ef95012c2cfe5f546d71af07b639e93 |
| Linux/Linuxgeneric | 6.6 | Not reported |
Published upstream
Feb 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 16, 2026
In the Linux kernel, the following vulnerability has been resolved: libceph: reset sparse-read state in osd_fault() When a fault occurs, the connection is abandoned, reestablished, and any pending operations are retried. The OSD client tracks the progress of a sparse-read reply using a separate state machine, largely independent of the messenger's state. If a connection is lost mid-payload or the sparse-read state machine returns an error, the sparse-read state is not reset. The OSD client will then interpret the beginning of a new reply as the continuation of the old one. If this makes the sparse-read machinery enter a failure state, it may never recover, producing loops like: libceph: [0] got 0 extents libceph: data len 142248331 != extent len 0 libceph: osd0 (1)...:6801 socket error on read libceph: data len 142248331 != extent len 0 libceph: osd0 (1)...:6801 socket error on read Therefore, reset the sparse-read state in osd_fault(), ensuring retries start from a clean state.
Quoted source text, attributed separately from HOL analysis.