Executive brief
A race condition was identified in the Linux kernel's RADOS Block Device (RBD) driver during the process of unmapping storage images. This flaw could allow background locking tasks to continue running even after the system believes they have stopped, potentially leading to a system crash or kernel panic when the driver attempts to access memory that has already been freed. This primarily affects the stability of systems using Ceph-based network storage.
Technical details
A Time-of-Check Time-of-Use (TOCTOU) race condition exists in the Linux kernel RBD driver's lock_dwork draining mechanism. Specifically, in the maybe_kick_acquire() function, a delayed work item (lock_dwork) can be requeued immediately after a cancellation attempt if a new I/O request arrives during an unmap operation. This allows rbd_acquire_lock() to execute after rbd_dev_device_release() and rbd_dev_image_release() have already freed associated data structures. The resulting execution against freed memory triggers kernel assertions (e.g., rbd_image_format_valid) and potential memory corruption. The fix involves re-implementing exclusive lock task draining using disable_delayed_work_sync() to ensure tasks cannot be requeued during the shutdown sequence.
Affected products
- Linux Linux Kernel All versions prior to 6.10, 6.9.4, 6.6.33, 6.1.93
Timeline
- 2026-05-19: other: Patch authored by Ilya Dryomov
- 2026-06-01: patched: Commits merged into stable branches
- 2026-07-19: disclosed: CVE published