Linux Kernel CVE-2026-64112

Exploitation requires the affected host to actually use the Ceph rbd driver with at least one mapped RADOS block device, and requires the attacker to be able to perform or influence rbd map/unmap operations while concurrent I/O is outstanding - the race is between lock_dwork draining during rbd_dev_image_unlock() and its requeue via maybe_kick_acquire(). Limiting factors: it is local-only (AV:L), it needs the privilege to map/unmap rbd images (typically root/CAP_SYS_ADMIN, not an unprivileged user despite the input vector's PR:L), it needs a precise timing window (a hard-to-win TOCTOU race, not a deterministic trigger), and it is inapplicable on systems where the rbd module is never loaded. There is no remote or unauthenticated path.

The supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) reflects local access with low privileges and full CIA impact, but several signals argue for a lower real-world priority. EPSS is only 0.17% (6th percentile), the vulnerability is not on CISA KEV, and no POC is referenced - so this is not confirmed actively exploited. The bug is a race that requires the ability to map/unmap Ceph rbd images (an operation typically requiring root/CAP_SYS_ADMIN) plus precise timing against concurrent I/O and an unmap, which realistically pushes attack complexity higher and privileges higher than the AC:L/PR:L in the input vector suggests. The most reliably reachable outcome is a kernel oops/panic (denial of service) via the violated rbd_assert; broader confidentiality/integrity impact via use-after-free is plausible but not demonstrated. Note a data conflict: the intelligence Tags label this 'Information Disclosure', while the CVSS and description point to a memory-safety/DoS race - verify impact classification with the vendor. Overall: a legitimate correctness bug worth patching in Ceph-backed hosts, but low urgency absent exploitation evidence.

A local user with the privilege to manage Ceph rbd devices repeatedly issues I/O against a mapped image and then unmaps it, racing the lock_dwork cancellation so a lock-acquisition work item runs after the device is torn down. Winning the race dereferences freed rbd_device state, tripping the format-validity assertion and crashing the kernel (DoS), with a possibility of exploitable memory corruption. No public POC is referenced, and the local, timing-dependent nature makes reliable exploitation difficult.