Executive brief
The Ceph filesystem driver in the Linux kernel contains a memory leak bug that prevents proper cleanup of cached inode references when write operations are aborted during system shutdown. This causes inodes to remain locked in memory even after the filesystem is unmounted, potentially leading to system crashes or hangs during shutdown if many files have pending writes.
Technical details
The vulnerability is a resource leak in the Ceph filesystem's writeback handling during umount. When ceph_submit_write() fails at the osd_stopping_blocker check during shutdown, folios are redirtied and unlocked without releasing their wrbuffer claims. The redirtying process bypasses ceph_dirty_folio(), so the claim bookkeeping is not rebalanced. Since subsequent writebacks also fail the blocker, i_wrbuffer_ref never returns to zero, the inode hold reference is never dropped, and the inode cannot be evicted, triggering a kernel panic ("Busy inodes after unmount"). The fix calls ceph_undo_wrbuffer_claim() to explicitly release the orphaned claims before redirtying, matching what writepages_finish() would do for submitted writes.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-11: disclosed