Junglewise Threat Intelligence

CVE-2026-52962: Linux Kernel memory leak in Ceph __ceph_setxattr

CVE-2026-52962 · Severity: info · CVSS 0 · Published 2026-06-24

Vendors: Linux.

Executive brief

A memory leak vulnerability was identified in the Linux kernel's Ceph file system component. This issue occurs when setting extended attributes, potentially leading to a gradual depletion of system memory over time. While not immediately critical, such leaks can eventually cause system instability or performance degradation in environments using Ceph storage.

Technical details

A buffer leak exists in the fs/ceph/xattr.c component of the Linux kernel. The function __ceph_setxattr() fails to release a reference to the 'old_blob' object during retry operations. Specifically, the code does not call ceph_buffer_put() for the old_blob object when it stores the ci->i_xattrs.prealloc_blob value. This results in a reference count leak, preventing the memory from being reclaimed. The vulnerability is reachable via local system calls that manipulate extended attributes (xattrs) on a Ceph mount. Patches have been released across multiple stable kernel branches to ensure proper reference counting.

Affected products

  • Linux Linux 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10

Timeline

  • 2026-06-24: disclosed: CVE published to NVD
  • 2026-05-11: patched: Initial fix committed to mainline kernel

References