Executive brief
A vulnerability in the Linux kernel's Ceph file system client can cause a system to hang or become unresponsive. When the system processes certain file lookup requests, it may incorrectly handle internal memory structures, leading to an infinite loop that consumes processor resources. This can result in a denial-of-service condition where the affected server stops responding to legitimate requests.
Technical details
A vulnerability exists in the Ceph file system implementation within the Linux kernel (specifically in fs/ceph/dir.c) where the code incorrectly assumes that a 'negative' dentry is also 'unhashed'. In ceph_finish_lookup() and ceph_lookup(), the kernel may call d_add(dentry, NULL) on a negative dentry that is already present in the primary dcache hash. This causes __d_rehash() to unconditionally reinsert the dentry into the hlist_bl bucket, potentially creating a self-loop or other corruption. Subsequent calls to __d_lookup() can then enter an infinite loop while walking the corrupted hash list, leading to CPU soft lockups and RCU stall reports. The fix ensures d_add() is only called if the dentry is actually unhashed.
Affected products
- Linux Linux kernel 6.18.17-i1-amd; fixed in 2010cb0, 4179cc3, 803447f, 83ce43a, b91e535
Timeline
- 2026-03-27: other: Patch authored
- 2026-05-27: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/2010cb06b9df7d3c816c78358c566bdacbdf38ff
- https://git.kernel.org/stable/c/4179cc390dacebc87079419ec92f86f3dc46294d
- https://git.kernel.org/stable/c/803447f93d75ab6e40c85e6d12b5630d281d70d6
- https://git.kernel.org/stable/c/83ce43a21bb7df8dd52228afdd918d2d058eefde
- https://git.kernel.org/stable/c/b91e535f208c48a5e7464f1aa38338a30e7912df