Skip to main content

Linux Kernel CVE-2026-52960

| EUVDEUVD-2026-38828 HIGH
2026-06-24 Linux GHSA-928w-8whm-4cq9
Information Disclosure Linux Red Hat Suse
High
Disputed · 7.5 Vendor: Linux
Share

Severity by source

Sources disagree (Low–High)
Vendor (Linux) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Requires local I/O on a CephFS mount (AV:L, PR:L) via a simple write loop (AC:L); leak causes memory exhaustion so impact is availability-only (A:H, C:N, I:N).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
3.3 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 08:36 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.5 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:28 cve.org
HIGH 7.5
CVE Published
Jun 24, 2026 - 16:28 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ceph: put folios not suitable for writeback

The batch holds references to the folios (see filemap_get_folios, folio_batch_release), so we need to folio_put the folios we remove.

Tested on v6.18.

AnalysisAI

Denial of service in the Linux kernel's CephFS (ceph) client allows local users with an active CephFS mount to leak kernel memory by triggering the dirty-page writeback path. The flaw stems from a missing reference release on folios that the writeback batch holds but removes as unsuitable, gradually pinning pages and exhausting kernel memory (CVSS 7.5, availability-only). No public exploit identified at time of analysis; EPSS is low at 0.16% (6th percentile), and it is not in CISA KEV.

Technical ContextAI

The vulnerable code lives in the Ceph distributed filesystem client (fs/ceph) of the Linux kernel, specifically its writeback logic for flushing dirty page-cache folios back to a Ceph object store. The kernel page cache now uses folios (compound page descriptors); routines like filemap_get_folios populate a folio_batch that takes a reference on each folio, and folio_batch_release later drops those references. The bug is a reference-counting / memory-leak class issue (akin to CWE-401, though the input lists CWE as N/A): when the writeback path identifies folios that are not suitable for writeback and removes them from the batch, it failed to call folio_put on them, so their elevated refcount is never returned and the pages cannot be freed. The fix adds the missing folio_put calls. The issue was observed/tested on kernel v6.18.

RemediationAI

Patch available per vendor advisory: apply the upstream stable fixes referenced at https://git.kernel.org/stable/c/86921e890fe1dea9791fb70bec552516fd47716a and https://git.kernel.org/stable/c/544576f0f05c4a759806acddfaaeb686f14fb4b0 by updating to the corresponding patched stable kernel from your distribution (the released, distro-tagged patched version is not independently confirmed from the input, so rely on your vendor's backport that cites this CVE). If you cannot patch immediately, the most effective compensating control is to avoid the vulnerable code path: do not mount CephFS on the affected hosts, or unload/blacklist the ceph kernel module where the filesystem is not required (trade-off: removes CephFS functionality entirely). On hosts that must keep CephFS, restrict which local users can perform heavy I/O against the mount and monitor kernel memory/slab and reclaimable page counts so a slow leak can be caught and mitigated by reboot before it exhausts memory (trade-off: detection/operational overhead, not prevention).

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-52960 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy