Executive brief
Linux CephFS (a distributed file system) crashes when accessing snapshot directories due to incorrect memory deallocation in the kernel. A user simply listing snapshots on a mounted CephFS volume causes the kernel to crash. This breaks access to snapshot data and may prevent systems from completing boot if the mount is referenced in fstab.
Technical details
The vulnerability is a use-after-free / invalid pointer dereference in the CephFS parse_longname() function (fs/ceph/crypto.c). The code allocates memory for a snapshot name via kmemdup_nul(), then advances the pointer by one byte to skip an underscore prefix, but the __free(kfree) cleanup annotation uses the original pointer. When the function returns, kfree() is called with a pointer offset by one byte, causing a kernel oops. Attack vector is local and unprivileged: any user with read access to a mounted CephFS .snap directory can trigger the crash. The fix changes kmemdup_nul() to skip the underscore during allocation rather than after, ensuring kfree() receives the correct pointer. Patches are available in upstream Linux kernel stable branches.
Affected products
- Linux Linux kernel Multiple versions (affected kernels with CephFS support; fixed in stable branches)
Timeline
- 2026-02-14: disclosed: Published on NVD
- 2026-02-03: patched: Upstream fix merged (commit bc8dedae)
- 2026-02-11: patched: Stable kernel fix applied (commit 8c9af73)