CVE-2026-22990 — Reachable Assertion in Linux

CWE-617 — Reachable Assertion22 documents7 sources
Severity
5.5MEDIUMNVD
OSV7.8
EPSS
0.0%
top 99.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
LinuxLinux KernelDebian Linux+1 more
Timeline
PublishedJan 23
Latest updateApr 13

Description

In the Linux kernel, the following vulnerability has been resolved: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() If the osdmap is (maliciously) corrupted such that the incremental osdmap epoch is different from what is expected, there is no need to BUG. Instead, just declare the incremental osdmap to be invalid.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages6 packages

▶NVDlinux/linux_kernel2.6.34.1 — 5.10.248+7
▶Debianlinux/linux_kernel< 5.10.249-1+3
▶Ubuntulinux/linux_kernel< 5.15.0-173.183
▶CVEListV5linux/linuxf24e9980eb860d8600cbe5ef3d2fd9295320d229 — 9aa0b0c14cefece078286d78b97d4c09685e372d+7
▶debiandebian/linux< linux 6.1.162-1 (bookworm)

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

9
OSV
linux-raspi vulnerabilities↗2026-04-01
▶
OSV
linux-intel-iot-realtime vulnerabilities↗2026-03-23
▶
OSV
linux-nvidia-tegra-igx vulnerabilities↗2026-03-23
▶
OSV
linux-realtime vulnerabilities↗2026-03-17
▶
OSV
linux-aws-5.15, linux-gcp-5.15, linux-gke, linux-hwe-5.15, linux-intel-iotg-5.15, linux-lowlatency-hwe-5.15, linux-oracle-5.15 vulnerabilities↗2026-03-17
▶

📋Vendor Advisories

11
Ubuntu
Linux kernel (Azure) vulnerabilities↗2026-04-13
▶
Ubuntu
Linux kernel (Azure FIPS) vulnerabilities↗2026-04-09
▶
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities↗2026-04-01
▶
Ubuntu
Linux kernel (Intel IoTG Real-time) vulnerabilities↗2026-03-23
▶
Ubuntu
Linux kernel (NVIDIA Tegra IGX) vulnerabilities↗2026-03-23
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-22990 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-22990 — Reachable Assertion in Linux | cvebase