Executive brief
Ceph is a distributed storage system commonly used in cloud and enterprise environments. A vulnerability in how the Linux kernel handles filename decryption for Ceph can cause system crashes (kernel panics) when processing directory information, particularly on non-x86 platforms. This could lead to denial of service or potential privilege escalation depending on platform-specific memory management.
Technical details
The vulnerability exists in the Ceph subsystem's filename decryption logic (ceph_fname_to_usr function), which uses the fscrypt API that requires buffers to be in the linear kernel address space. However, the Ceph messenger client uses kvmalloc() which can place buffers in the vmalloc region under memory pressure. When decrypting filenames from MDS messages stored in vmalloc buffers, this causes a violation of the fscrypt API contract, resulting in oopses (kernel panics), especially on non-x86 architectures. The fix implements a bounce-buffer mechanism that detects vmalloc-allocated fname and oname buffers and temporarily copies them to linear memory before passing to fscrypt functions. This resolves the API contract violation and prevents the crashes during directory listing operations on encrypted Ceph filesystems.
Affected products
- Linux Linux Kernel affected versions prior to fix
Timeline
- 2026-09-16: disclosed: CVE-2026-90042 published
- 2026-09-16: patched: Fix merged into Linux kernel (ceph_fname_to_usr bounce buffer implementation)