Executive brief
A memory leak vulnerability was identified in the Linux kernel's Ceph file system component. This issue occurs when setting extended attributes, potentially leading to a gradual depletion of system memory over time. While not immediately critical, such leaks can eventually cause system instability or performance degradation in environments using Ceph storage.
Technical details
A buffer leak exists in the fs/ceph/xattr.c component of the Linux kernel. The function __ceph_setxattr() fails to release a reference to the 'old_blob' object during retry operations. Specifically, the code does not call ceph_buffer_put() for the old_blob object when it stores the ci->i_xattrs.prealloc_blob value. This results in a reference count leak, preventing the memory from being reclaimed. The vulnerability is reachable via local system calls that manipulate extended attributes (xattrs) on a Ceph mount. Patches have been released across multiple stable kernel branches to ensure proper reference counting.
Affected products
- Linux Linux 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10
Timeline
- 2026-06-24: disclosed: CVE published to NVD
- 2026-05-11: patched: Initial fix committed to mainline kernel
References
- https://git.kernel.org/stable/c/3fa13ceefbc5f36131110342743994cb3de80637
- https://git.kernel.org/stable/c/4bfdcefdaa6092a06cacd59389c7756b36e6de8c
- https://git.kernel.org/stable/c/521e5aba857fd267624892c8dd6295f22ce0267e
- https://git.kernel.org/stable/c/5d3cc36b4e77a27ce7b686b7c59c7072bcb3fa8e
- https://git.kernel.org/stable/c/7d3e8d2d648d5f0df29b4710246680f47695fe94
- https://git.kernel.org/stable/c/bc7abce4460e490dcb579eec770f175b150b685f
- https://git.kernel.org/stable/c/d0cb994605c84a159c1d00d72cdc8583c321ef95