CVE-2026-23136

What it actually does

Failure to reset sparse-read state machine on connection fault in libceph causes the OSD client to misinterpret new replies as continuations of prior partial reads, entering unrecoverable error loops that trigger repeated socket errors and prevent recovery.

Why it matters to the business

Ceph-based storage clusters may experience prolonged unavailability or degraded performance after transient network faults, requiring manual intervention or restarts to restore service; widespread impact on Linux distributions using Ceph for distributed storage.

How an attack unfolds

An attacker with network access to Ceph OSD endpoints triggers a mid-payload connection fault or sparse-read error; the unreset state machine then loops on subsequent legitimate replies, sustaining denial of service without needing further interaction.

How to fix it

Update the Linux kernel to a version containing commit 90a60fe61908afa0eaf7f8fcf1421b9b50e5f7ff which resets sparse-read state inside osd_fault(); apply the fix via distribution kernel packages or rebuild from the stable git tree.

How to confirm the fix worked

Confirm the presence of commit 90a60fe61908afa0eaf7f8fcf1421b9b50e5f7ff in the running kernel source; test by inducing OSD connection faults during sparse reads and verifying absence of repeated libceph error messages.

Typical attack path

1. Establish or intercept connection to Ceph OSD
2. Induce fault during sparse-read reply payload transfer
3. Observe or force sparse-read state machine error
4. Trigger retry of operations on reestablished connection
5. Exploit unreset state to enter persistent error loop

How to detect it

Search Ceph and kernel logs for repeated instances of 'got 0 extents', 'data len .* != extent len 0', and 'socket error on read' originating from libceph; correlate with OSD connection resets.

What your security team should do

• Prioritize kernel updates containing the referenced commit on all Ceph client nodes
• Monitor Ceph OSD logs for the specific sparse-read error patterns until patched
• Implement connection retry limits and health checks as temporary mitigation