Executive brief
The Linux kernel's Ceph filesystem driver can hang indefinitely when processing read requests under certain conditions involving capability revocation. This denial-of-service vulnerability can leave applications frozen waiting for file access, disrupting system availability until the system is restarted or manual intervention occurs.
Technical details
This vulnerability is a denial-of-service condition in the Ceph filesystem driver's capability management code. The root cause is a race condition in __ceph_get_caps() where `cap->mds_wanted` can become stale when capability revocation occurs (e.g., when another client performs conflicting operations). If a cap update message fails to reach the MDS after `mds_wanted` is raised, try_get_cap_refs() returns 0 causing the reader to wait on `i_cap_wq`. No further request is sent, and the waiter sleeps indefinitely until unrelated cap traffic awakens it. The fix implements a bounded wait timeout in __ceph_get_caps() and modifies ceph_renew_caps() to issue synchronous OPEN requests when wanted capabilities are not actually issued, bypassing reliance on stale `mds_wanted` state. The patch is available in the Linux kernel.
Affected products
- Linux Linux kernel affected versions prior to fix (specific version not specified in advisory)
Timeline
- 2026-08-26: disclosed
- 2026-08-26: patched: Fix implemented in kernel patch