Executive brief
A race condition in the Linux kernel's Ceph file system client could allow a local user to cause system instability or data corruption. The issue occurs when concurrent file operations, such as renaming a directory, cause the system to apply changes to the wrong directory. This could lead to unauthorized data modification or a system crash.
Technical details
A race condition exists in the Ceph file system client within the Linux kernel due to improper validation of the r_parent directory inode before applying state changes from Metadata Server (MDS) replies. When concurrent operations like renames occur, r_parent can become stale between the initiation of a request and the processing of its reply. This flaw also involves improper handling of CEPH_CAP_PIN references, leading to reference leaks or underflows. An attacker with local access could exploit this to cause a denial of service (system crash) or potentially corrupt file system metadata. Patches have been released for various stable kernel branches including 6.12.48 and 6.16.8.
Affected products
- Linux Linux Kernel 2.6.34 to 6.16.8
Timeline
- 2025-10-01: disclosed: Vulnerability published
- 2025-09-09: patched: Initial fix committed to mainline kernel