Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N U N N H 5.5 .0033 24.3 —
AFFECTED Product Versions Fixed Linux f628d799972799023d32c2542bb2639eb8c4f84e – — Linux 6.6 – 6.6.121
TIMELINE Jan 13 Reserved by Linux Feb 14 Published (CNA: Linux) Oct 16 RESCORED — CVE-2026-23136 (Linux). CVSS 7.5 → 5.5 (NVD).
In the Linux kernel, the following vulnerability has been resolved: libceph: reset sparse-read state in osd_fault() When a fault occurs, the connection is abandoned, reestablished, and any pending operations are retried. The OSD client tracks the progress of a sparse-read reply using a separate state machine, largely independent of the messenger's state. If a connection is lost mid-payload or the sparse-read state machine returns an error, the sparse-read state is not reset. The OSD client will then interpret the beginning of a new reply as the continuation of the old one. If this makes the sparse-read machinery enter a failure state, it may never recover, producing loops like: libceph: [0] got 0 extents libceph: data len 142248331 != extent len 0 libceph: osd0 (1)...:6801 socket error on read libceph: data len 142248331 != extent len 0 libceph: osd0 (1)...:6801 socket error on read Therefore, reset the sparse-read state in osd_fault(), ensuring retries start from a clean state.
| Date | Event | Detail |
|---|---|---|
| January 13, 2026 | Reserved | Reserved by Linux |
| February 14, 2026 | Published | Published (CNA: Linux) |
| October 16, 2026 | RESCORED | RESCORED — CVE-2026-23136 (Linux). CVSS 7.5 → 5.5 (NVD). |
Authoritative record: CVE-2026-23136 at cve.org
Vendors: linux
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-23136 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
