Executive brief
A memory leak vulnerability was identified in the Linux kernel's Ceph file system component. This component allows computers to connect to Ceph storage clusters. If exploited, this flaw could allow a local user to gradually exhaust the system's available memory, potentially leading to a system crash or service outage.
Technical details
A memory leak (CWE-401) exists in the Linux kernel's Ceph MDS client. The function 'ceph_mdsc_build_path()' in 'fs/ceph/mds_client.c' fails to release memory allocated via '__getname()' in several error-handling code paths. Specifically, if the function encounters an error or a path exceeds 'PATH_MAX', it returns without calling '__putname()', leaking the 'path' pointer. A local attacker could trigger these error paths repeatedly to exhaust kernel memory, leading to a denial-of-service (DoS). Patches have been released across multiple stable kernel branches to ensure '__putname()' is called before returning in these scenarios.
Affected products
- Linux Linux Kernel 5.10.234 to 5.11; 5.15.177 to 5.16; 6.1.125 to 6.2; 6.6 to 6.6.130; 6.7 to 6.12.78; 6.13 to 6.18.19; 6.19 to 6.19.9
Timeline
- 2026-05-08: disclosed
- 2026-05-08: advisory
References
- https://git.kernel.org/stable/c/040d159a45ded7f33201421a81df0aa2a86e5a0b
- https://git.kernel.org/stable/c/097cd68f46686391a98f2618188f0cb7b7570de2
- https://git.kernel.org/stable/c/13b8b9d6f59ef17fb96c298c3a0d62a8306950cc
- https://git.kernel.org/stable/c/5895d0164c84d7fec6abc198920c257f55c51899
- https://git.kernel.org/stable/c/657dc653b06a3cc0282aea447a3f137fa94066a4