Executive brief
A vulnerability was identified in the Linux kernel's RADOS Block Device (RBD) driver, which is used to map Ceph storage images as local block devices. Under specific error conditions during device setup, the system could attempt to clean up the same resource twice, leading to a system crash (kernel panic). This could result in a denial-of-service, impacting the availability of the host system and any services relying on Ceph storage.
Technical details
The vulnerability is a null pointer dereference in the RBD driver's error handling path within do_rbd_add(). When device_add_disk() fails after a successful device_add(), the driver incorrectly calls rbd_free_disk() twice—once directly in the error path and once via rbd_dev_device_release(). This double teardown causes blk-mq cleanup to operate on invalid state, specifically triggering a null-ptr-deref in __blk_mq_free_map_and_rqs(). An attacker or a system error triggering this specific failure during RBD image mapping can cause a kernel panic. The fix ensures proper teardown ordering by calling device_del() before releasing the device.
Affected products
- Linux Linux Kernel v6.13-rc1 to v7.0
Timeline
- 2026-04-19: patched: Initial patch authored
- 2026-05-27: advisory: CVE published
References
- https://git.kernel.org/stable/c/059fb7656723c1b77c2fc0e64b7aa99d6bb65e8e
- https://git.kernel.org/stable/c/2f4809a879f0750c7790bbeeae86c9505797a06f
- https://git.kernel.org/stable/c/564cd8f4aeb9a938e470c5c91922fd02e4d41acc
- https://git.kernel.org/stable/c/ad0126ffcba8777109852979eaaa6dca6703abdb
- https://git.kernel.org/stable/c/d1fef92e414433ca7b89abf85cb0df42b8d475eb