CVE-2026-23136

In the Linux kernel, the following vulnerability has been resolved:

libceph: reset sparse-read state in osd_fault()

When a fault occurs, the connection is abandoned, reestablished, and any

pending operations are retried. The OSD client tracks the progress of a

sparse-read reply using a separate state machine, largely independent of

the messenger's state.

If a connection is lost mid-payload or the sparse-read state machine

returns an error, the sparse-read state is not reset. The OSD client

will then interpret the beginning of a new reply as the continuation of

the old one. If this makes the sparse-read machinery enter a failure

state, it may never recover, producing loops like:

libceph: [0] got 0 extents

libceph: data len 142248331 != extent len 0

libceph: osd0 (1)...:6801 socket error on read

libceph: data len 142248331 != extent len 0

libceph: osd0 (1)...:6801 socket error on read

Therefore, reset the sparse-read state in osd_fault(), ensuring retries

start from a clean state.