Junglewise Threat Intelligence

CVE-2026-22992: Linux Kernel NULL pointer dereference in libceph mon_handle_auth_done

CVE-2026-22992 · Severity: high · CVSS 7.5 · Published 2026-01-23

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability in the Linux kernel's Ceph network storage client could allow a remote attacker to cause a system crash. The issue occurs during the authentication process when errors are not properly handled, leading to a system failure. This affects systems using Ceph for distributed storage, including certain industrial control components from Siemens.

Technical details

A NULL pointer dereference vulnerability exists in the libceph module of the Linux kernel due to improper error handling in mon_handle_auth_done(). When ceph_auth_handle_reply_done() returns an error, mon_handle_auth_done() fails to propagate this error, allowing the msgr2 protocol to attempt session establishment in the background. In secure mode, this inconsistency triggers a warning in setup_crypto() and subsequently leads to a NULL pointer dereference in prepare_auth_signature(). This can be exploited by a network-reachable attacker to cause a denial of service (kernel panic). Patches have been released for various stable kernel branches.

Affected products

  • Linux Linux Kernel cd1a677cad99 to 77229551f2cf72f3e35636db68e6a825b912cf16
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6

Timeline

  • 2026-01-23: advisory: Initial NVD publication
  • 2026-01-17: patched: Fix committed to stable kernel trees
  • 2026-07-14: other: Siemens advisory added to record

References

Related threats