Junglewise Threat Intelligence

CVE-2026-52961: Linux Kernel Ceph denial of service in xattr blob building

CVE-2026-52961 · Severity: info · CVSS 5.5 · Published 2026-06-24

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Ceph file system component can cause a system crash (kernel panic). This occurs due to a synchronization error when handling file attributes (xattrs), where the system incorrectly calculates the memory needed for data storage during a race condition. An attacker or a malfunctioning process could trigger this crash, leading to a denial of service for the affected system.

Technical details

A race condition exists in the Ceph file system driver within the Linux kernel. The function __build_xattrs() releases and reacquires i_ceph_lock, creating a window where handle_cap_grant() can update the xattr blob and version. If the xattr tree is rebuilt during this window, the previously calculated required_blob_size becomes stale. Subsequent operations may use a preallocated buffer that is too small for the updated tree, eventually triggering a BUG_ON in __ceph_build_xattrs_blob() during the capability flush path. This results in a kernel panic (Oops: invalid opcode). The fix involves recomputing the required blob size after the lock is reacquired.

Affected products

  • Linux Linux Kernel 7.0.0-rc7+; fixed in 0c22d9511cbde746622f8e4c11aaa63fe76d45f9 and related stable backports

Timeline

  • 2026-04-09: disclosed: Date of original patch submission
  • 2026-05-11: patched: Patch committed to mainline kernel
  • 2026-06-24: advisory: CVE published in NVD dataset

References

Related threats