Executive brief
A vulnerability in the Linux kernel's Ceph file system component can cause a system crash (kernel panic). This occurs due to a synchronization error when handling file attributes (xattrs), where the system incorrectly calculates the memory needed for data storage during a race condition. An attacker or a malfunctioning process could trigger this crash, leading to a denial of service for the affected system.
Technical details
A race condition exists in the Ceph file system driver within the Linux kernel. The function __build_xattrs() releases and reacquires i_ceph_lock, creating a window where handle_cap_grant() can update the xattr blob and version. If the xattr tree is rebuilt during this window, the previously calculated required_blob_size becomes stale. Subsequent operations may use a preallocated buffer that is too small for the updated tree, eventually triggering a BUG_ON in __ceph_build_xattrs_blob() during the capability flush path. This results in a kernel panic (Oops: invalid opcode). The fix involves recomputing the required blob size after the lock is reacquired.
Affected products
- Linux Linux Kernel 7.0.0-rc7+; fixed in 0c22d9511cbde746622f8e4c11aaa63fe76d45f9 and related stable backports
Timeline
- 2026-04-09: disclosed: Date of original patch submission
- 2026-05-11: patched: Patch committed to mainline kernel
- 2026-06-24: advisory: CVE published in NVD dataset