Executive brief
A race condition in the Linux kernel's Ceph file system client could allow a local user to trigger a system warning or instability. The issue occurs when the system attempts to delete files asynchronously and incorrectly calculates internal file reference counters. This can lead to a kernel state error (underrun) if multiple clients attempt to delete the same file simultaneously.
Technical details
A Time-of-Check Time-of-Use (TOCTOU) race condition exists in the Ceph file system driver (fs/ceph/dir.c) during asynchronous unlink operations. When 'ceph_unlink' is called, it submits an unlink request to the Metadata Server (MDS) and immediately decrements the inode's link count ('i_nlink') without waiting for completion. If a worker thread processes a completion message or capability grant from the MDS that sets 'i_nlink' to zero before 'drop_nlink' is called, the counter underruns, triggering a kernel warning. The fix introduces 'i_ceph_lock' spinlock protection and a check to ensure 'i_nlink' is greater than zero before decrementing.
Affected products
- Linux Linux Kernel 5.7 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9
Timeline
- 2025-09-05: patched: Initial patch authored
- 2026-05-08: disclosed: CVE published
References
- https://git.kernel.org/stable/c/6d5fd8bb574bef039eb3b738e523870433a2aeb9
- https://git.kernel.org/stable/c/7db008e85a5d17b64bc5390b828bf457ae91a415
- https://git.kernel.org/stable/c/8975b85b0d45ca811ace6fac5907652f2310e5ac
- https://git.kernel.org/stable/c/9b31e88ac5623d15c8bc46f69dfe1d3b43a8f67c
- https://git.kernel.org/stable/c/aedd29386b23f3e1e6818943e11abfff2953732f
- https://git.kernel.org/stable/c/b3f5513141ecc6b277a8f7b7efe58a0cf9a5e859
- https://git.kernel.org/stable/c/ce0123cbb4a40a2f1bbb815f292b26e96088639f