CoreCVE
Back

HIGH

libceph: reset sparse-read state in osd_fault()

Published Feb 14, 2026

Description

When a fault occurs, the connection is abandoned, reestablished, and any pending operations are retried. The OSD client tracks the progress of a sparse-read reply using a separate state machine, largely independent of the messenger's state.

If a connection is lost mid-payload or the sparse-read state machine returns an error, the sparse-read state is not reset. The OSD client will then interpret the beginning of a new reply as the continuation of the old one. If this makes the sparse-read machinery enter a failure state, it may never recover, producing loops like:

libceph: [0] got 0 extents libceph: data len 142248331 != extent len 0 libceph: osd0 (1)...:6801 socket error on read libceph: data len 142248331 != extent len 0 libceph: osd0 (1)...:6801 socket error on read

Therefore, reset the sparse-read state in osd_fault(), ensuring retries start from a clean state.

Affected products

Remediation

Red Hat statement

A reliability and availability issue exists in the libceph OSD client sparse read handling. The client tracks progress of a sparse read reply using a separate state machine. When a connection fault happens mid payload or when the sparse read state machine returns an error, the connection is abandoned and later reestablished and pending operations are retried. However the sparse read state was not reset on the fault path. As a result the client can misinterpret the beginning of a new reply as a continuation of the previous reply. This can drive the sparse read machinery into a persistent failure mode that may never recover, producing repeated error messages and repeated socket read failures, effectively preventing successful reads and causing continuous retry loops. From a threat perspective the trigger can be a misbehaving or compromised Ceph OSD server, or a network adversary able to disrupt or truncate traffic, causing fault and retry sequences. The primary impact is denial of service for Ceph clients performing sparse reads.

Weaknesses (1)

CWE-440

References (10)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Linux
Published Feb 14, 2026
Updated Aug 5, 2026
Reserved Jan 13, 2026
Link CVE-2026-23136
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2026-23136
Red Hat
Severity Moderate
Public date Feb 14, 2026
Links CVE-2026-23136 - Bugzilla
ENISA EUVD
Assigner Linux
Published Feb 14, 2026
Updated Aug 5, 2026
Exploited since n/a
Link EUVD-2026-5901
EUVD-2026-5901