Skip to main content

Linux Kernel CVE-2026-52961

| EUVDEUVD-2026-38829 MEDIUM
Reachable Assertion (CWE-617)
2026-06-24 Linux GHSA-7c47-vxfh-p7q4
Denial Of Service Linux Debian Ubuntu
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local shell with low privileges
  2. Delivery
    Identify active CephFS mount on system
  3. Exploit
    Perform sustained xattr writes on Ceph-backed files
  4. Execution
    MDS cap grant races with __build_xattrs() in ceph-msgr workqueue
  5. Persist
    BUG_ON assertion fires at xattr.c:918
  6. Impact
    Kernel panic crashes entire system

Vulnerability Assessment

Weakness
CWE
CWE-617
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
Exploitation Conditions

Three concrete prerequisites must hold simultaneously: (1) The target kernel must have the CephFS client module loaded and at least one Ceph filesystem actively mounted - systems without CephFS mounts are completely unaffected regardless of kernel version. (2) The attacker must hold a local shell session or equivalent process execution capability with at least low-privileged credentials (PR:L per CVSS); no network-remote exploitation path exists. (3) The race requires a concurrent MDS cap grant message to arrive via the ceph-msgr workqueue during the unlocked window inside __build_xattrs() - this occurs naturally under normal Ceph activity and is not attacker-controlled, meaning it can be triggered organically by sustained xattr write operations without precise timing. Exploitation is limited to systems running kernel versions in the 6.0-6.12.90, 6.0-6.18.32, and 6.0-7.0.9 ranges. Single-tenant or service-only Ceph nodes where no untrusted local users exist face no realistic threat despite technical vulnerability.
Impact

The CVSS 5.5 Medium score with AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H correctly captures the bounded scope: local access and an active Ceph mount are prerequisites, while the impact is exclusively kernel availability (system-wide panic). The EPSS score of 0.20% at the 10th percentile, combined with no KEV listing and no public exploit, indicates this is currently a low-exploitation-likelihood issue in the broader threat landscape. However, real-world risk is meaningfully elevated for environments that specifically deploy CephFS: HPC clusters, OpenStack deployments, and enterprise object/block storage systems where the Ceph kernel client is loaded and local or container-level access exists. The race is reliably reproducible by the xfstests generic/642 test case, confirming it is not purely theoretical under load. The AC:L assigned by NVD may slightly understate the actual complexity since the race requires a concurrent MDS network event, though under active Ceph workloads this occurs organically without attacker engineering. No CVSS signal conflicts are present; the provided vector is internally consistent with the described behavior.
Exploit ScenarioDerived

A local unprivileged user on a multi-tenant system with a CephFS mount performs repeated extended attribute write operations on Ceph-backed files. Concurrently, the MDS server issues a cap grant message that updates the inode's xattr blob via handle_cap_grant() in the ceph-msgr workqueue. The stale required_blob_size causes the BUG_ON assertion to fire at fs/ceph/xattr.c:918, triggering an unrecoverable kernel panic and crashing the entire system. No exploit code is required; the xfstests generic/642 test reliably reproduces the condition under normal Ceph I/O load.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Ceph filesystem client in the Linux kernel panics with a BUG_ON assertion in __ceph_build_xattrs_blob() due to a race condition that leaves a pre-calculated xattr blob size stale, introduced by an earlier commit that restructured size computation order. All kernels from Linux 6.0 onward running a CephFS mount are affected, with fixed releases available at 6.12.91, 6.18.33, 7.0.10, and 7.1. A local low-privileged user with access to a Ceph-mounted filesystem can trigger a kernel panic causing complete system denial of service; no public exploit code or CISA KEV listing exists at time of analysis.

RemediationAI

The primary remediation is upgrading to a patched kernel: Linux 6.12.91, 6.18.33, 7.0.10, or 7.1 (mainline). Upstream stable commits are available at https://git.kernel.org/stable/c/7eb72425c4e3234926502eb262f9d6193ccd572c, https://git.kernel.org/stable/c/d5bd8b4e39cfa8b087448adcd48088065cd629d5, https://git.kernel.org/stable/c/368d21ae9081c93497b1c8163bed3eddcb2443ff, and https://git.kernel.org/stable/c/0c22d9511cbde746622f8e4c11aaa63fe76d45f9. Ubuntu users should apply packages referenced in USN-8568-1 through USN-8566-1 via https://ubuntu.com/security/notices/USN-8568-1. Where immediate patching is not possible, restricting local user access to CephFS mounts via POSIX ACLs or mount-level controls (e.g., limiting which UIDs may write extended attributes) reduces exposure, but does not eliminate the race - the crash can also be triggered by legitimate concurrent MDS traffic. Unmounting CephFS entirely on multi-tenant systems until patching is feasible is the most effective workaround, at the cost of service interruption.

Affected VersionsENISA

Linux patch: 0
Linux patch: 6.18.33
Linux 6.0
Linux patch: 7.0.10
Linux d93231a6bc8a452323d5fef16cca7107ce483a27 <0c22d9511cbde746622f8e4c11aaa63fe76d45f9
Linux patch: 6.12.91
Linux d93231a6bc8a452323d5fef16cca7107ce483a27 <368d21ae9081c93497b1c8163bed3eddcb2443ff
Linux d93231a6bc8a452323d5fef16cca7107ce483a27 <7eb72425c4e3234926502eb262f9d6193ccd572c
Linux patch: 7.1
Linux d93231a6bc8a452323d5fef16cca7107ce483a27 <d5bd8b4e39cfa8b087448adcd48088065cd629d5

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in fs/ceph/xattr.c within the Linux kernel's CephFS client subsystem (CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*). Commit d93231a6bc8a ('ceph: prevent a client from exceeding the MDS maximum xattr size') moved the required_blob_size computation to before the __build_xattrs() call. The problem is that __build_xattrs() releases and reacquires the i_ceph_lock spinlock during its execution. In that unlocked window, handle_cap_grant() - running asynchronously in the ceph-msgr kernel workqueue in response to a message from the Metadata Server (MDS) - can overwrite i_xattrs.blob with a fresher MDS-provided blob and increment i_xattrs.version. When __ceph_build_xattrs_blob() resumes, its previously-computed required_blob_size is now stale and incorrect, causing BUG_ON to fire at xattr.c:918. CWE-617 (Reachable Assertion) is accurate: a defensive invariant check becomes a kernel-crash vector through an unguarded TOCTOU race between the cap-grant handler and the xattr blob builder.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 4.7 MEDIUM

Race requires concurrent MDS network event during xattr write, warranting AC:H; AV:L and PR:L confirmed by CephFS mount and local access requirements; purely availability impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 14, 2026 - 16:22 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:28 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:28 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size

The generic/642 test-case can reproduce the kernel crash:

[40243.605254] ------------[ cut here ]------------ [40243.605956] kernel BUG at fs/ceph/xattr.c:918! [40243.607142] Oops: invalid opcode: 0000 [#1] SMP PTI [40243.608067] CPU: 7 UID: 0 PID: 498762 Comm: kworker/7:1 Not tainted 7.0.0-rc7+ #3 PREEMPT(full) [40243.609700] Hardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [40243.611820] Workqueue: ceph-msgr ceph_con_workfn [40243.612715] RIP: 0010:__ceph_build_xattrs_blob+0x1b8/0x1e0 [40243.613731] Code: 0f 84 82 fe ff ff e9 cf 8e 56 ff 48 8d 65 e8 31 c0 5b 41 5c 41 5d 5d 31 d2 31 c9 31 f6 31 ff 45 31 c0 45 31 c9 c3 cc cc cc cc <0f> 0b 4c 8b 62 08 41 8b 85 24 07 00 00 49 83 c4 04 41 89 44 24 fc [40243.616888] RSP: 0018:ffffcc80c4d4b688 EFLAGS: 00010287 [40243.617773] RAX: 0000000000010026 RBX: 0000000000000001 RCX: 0000000000000000 [40243.618928] RDX: ffff8a773798dee0 RSI: 0000000000000000 RDI: 0000000000000000 [40243.620158] RBP: ffffcc80c4d4b6a0 R08: 0000000000000000 R09: 0000000000000000 [40243.621573] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8a75f3b58000 [40243.622907] R13: ffff8a75f3b58000 R14: 0000000000000080 R15: 000000000000bffd [40243.624054] FS: 0000000000000000(0000) GS:ffff8a787d1b4000(0000) knlGS:0000000000000000 [40243.625331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [40243.626269] CR2: 000072f390b623c0 CR3: 000000011c02a003 CR4: 0000000000372ef0 [40243.627408] Call Trace: [40243.627839] <TASK> [40243.628188] __prep_cap+0x3fd/0x4a0 [40243.628789] ? do_raw_spin_unlock+0x4e/0xe0 [40243.629474] ceph_check_caps+0x46a/0xc80 [40243.630094] ? __lock_acquire+0x4a2/0x2650 [40243.630773] ? find_held_lock+0x31/0x90 [40243.631347] ? handle_cap_grant+0x79f/0x1060 [40243.632068] ? lock_release+0xd9/0x300 [40243.632696] ? __mutex_unlock_slowpath+0x3e/0x340 [40243.633429] ? lock_release+0xd9/0x300 [40243.634052] handle_cap_grant+0xcf6/0x1060 [40243.634745] ceph_handle_caps+0x122b/0x2110 [40243.635415] mds_dispatch+0x5bd/0x2160 [40243.636034] ? ceph_con_process_message+0x65/0x190 [40243.636828] ? lock_release+0xd9/0x300 [40243.637431] ceph_con_process_message+0x7a/0x190 [40243.638184] ? kfree+0x311/0x4f0 [40243.638749] ? kfree+0x311/0x4f0 [40243.639268] process_message+0x16/0x1a0 [40243.639915] ? sg_free_table+0x39/0x90 [40243.640572] ceph_con_v2_try_read+0xf58/0x2120 [40243.641255] ? lock_acquire+0xc8/0x300 [40243.641863] ceph_con_workfn+0x151/0x820 [40243.642493] process_one_work+0x22f/0x630 [40243.643093] ? process_one_work+0x254/0x630 [40243.643770] worker_thread+0x1e2/0x400 [40243.644332] ? __pfx_worker_thread+0x10/0x10 [40243.645020] kthread+0x109/0x140 [40243.645560] ? __pfx_kthread+0x10/0x10 [40243.646125] ret_from_fork+0x3f8/0x480 [40243.646752] ? __pfx_kthread+0x10/0x10 [40243.647316] ? __pfx_kthread+0x10/0x10 [40243.647919] ret_from_fork_asm+0x1a/0x30 [40243.648556] </TASK> [40243.648902] Modules linked in: overlay hctr2 libpolyval chacha libchacha adiantum libnh libpoly1305 essiv intel_rapl_msr intel_rapl_common intel_uncore_frequency_common skx_edac_common nfit kvm_intel kvm irqbypass joydev ghash_clmulni_intel aesni_intel rapl input_leds mac_hid psmouse vga16fb serio_raw vgastate floppy i2c_piix4 pata_acpi bochs qemu_fw_cfg i2c_smbus sch_fq_codel rbd dm_crypt msr parport_pc ppdev lp parport efi_pstore [40243.654766] ---[ end trace 0000000000000000 ]---

Commit d93231a6bc8a ("ceph: prevent a client from exceeding the MDS maximum xattr size") moved the required_blob_size computation to before the __build_xattrs() call, introducing a race.

__build_xattrs() releases and reacquires i_ceph_lock during execution. In that window, handle_cap_grant() may update i_xattrs.blob with a newer MDS-provided blob and bump i_xattrs.version. When __bui ---truncated---

Threat Intelligence Overview

EPSS Score
0.2%
Top 90% exploitable
Prevalence
Medium
CephFS widely deployed in OpenStack and HPC, not universal
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same weakness CWE-617 – Reachable Assertion

View all
CVE-2021-27212 HIGH POC
7.5
CVE-2025-15684 MEDIUM POC
5.5
CVE-2016-8864 HIGH
7.5
CVE-2026-27135 HIGH POC
7.5
CVE-2020-12417 HIGH POC
8.8
CVE-2020-6623 HIGH POC
8.8
CVE-2020-6619 HIGH POC
8.8
CVE-2020-6617 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.177 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.155 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.206 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.152 Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-52961 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/373300 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3130/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3166/ REF https://git.kernel.org/stable/c/0c22d9511cbde746622f8e4c11aaa63fe76d45f9 REF https://git.kernel.org/stable/c/0fe79375e48efee268e766c800bacbd58bed655b REF https://git.kernel.org/stable/c/368d21ae9081c93497b1c8163bed3eddcb2443ff REF https://git.kernel.org/stable/c/7eb72425c4e3234926502eb262f9d6193ccd572c REF https://git.kernel.org/stable/c/d161c4456672f8c431e3bdf9bea817b490d14181 REF https://git.kernel.org/stable/c/d5bd8b4e39cfa8b087448adcd48088065cd629d5

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy