CVE-2026-22992 libceph: return the handler error from mon_handle_auth_done()

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2026-22992 and CVE-2026-22984 Address libceph Vulnerabilities Two vulnerabilities in the libceph component have been identified: CVE-2026-22992, which involves returning the handler error from mon_handle_auth_done(), and CVE-2026-22984, which prevents potential out-of-bounds reads in handle_auth_done(). Both vulnerabilities were published on January 23, 2026, affecting systems utilizing the libceph library. 2 sources 39