Executive brief
The Linux kernel's Ceph distributed filesystem client contains a memory safety vulnerability in how it processes replies from metadata servers. When allocating memory during cache updates, the kernel can inadvertently trigger memory reclamation routines that corrupt filesystem state. This can cause the kernel to crash when other filesystems (such as ext4) interact with poisoned data structures, disrupting system stability and availability.
Technical details
The vulnerability is a memory safety issue in the Ceph filesystem client's handle_reply() function. The function stores a ceph_mds_request pointer in current->journal_info while updating inode and dentry caches from an MDS reply. Memory allocations in this critical section can trigger direct filesystem reclaim, which prunes dentries from unrelated filesystems. If ext4 inodes are dirtied during this pruning, ext4 begins a JBD2 transaction and interprets the Ceph request stored in journal_info as a journal handle, dereferencing internal fields as transaction pointers and causing a kernel oops. The fix wraps the vulnerable code section in a scoped NOFS (no filesystem) allocation context to prevent reclaim recursion while journal_info contains Ceph-private data. Network access to a Ceph MDS and ability to trigger crafted replies is the primary attack vector.
Affected products
- Linux Linux kernel 6.18.38 and likely other versions
Timeline
- 2026-08-26: disclosed