EUVD-2026-66594
GHSA-g3v4-jm6x-37fc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Crash-only DoS so C:N/I:N/A:H; needs a mounted CephFS plus a reclaim-timing race giving AV:L and AC:H, and PR:L reflects local/authenticated access to the affected client.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ceph: avoid fs reclaim while using current->journal_info
handle_reply() stores a ceph_mds_request pointer in current->journal_info while filling the inode and dentry cache from an MDS reply.
An allocation in this section can enter direct reclaim and prune dentries from another filesystem. If this dirties an ext4 inode, ext4 starts a JBD2 transaction. JBD2 interprets the Ceph request in current->journal_info as a journal handle and dereferences the request's r_tid as h_transaction, causing a kernel crash, e.g.:
Unable to handle kernel paging request at virtual address 00000000077b4818 [...] Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 6 UID: 0 PID: 2699135 Comm: kworker/6:3 Tainted: G W 6.18.38-i3 #1113 NONE [...] Workqueue: ceph-msgr ceph_con_workfn pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : jbd2__journal_start+0x2c/0x208 lr : __ext4_journal_start_sb+0x100/0x178 [...] Call trace: jbd2__journal_start+0x2c/0x208 (P) __ext4_journal_start_sb+0x100/0x178 ext4_dirty_inode+0x3c/0x90 __mark_inode_dirty+0x58/0x400 iput.part.0+0x2b0/0x370 iput+0x18/0x30 dentry_unlink_inode+0xc0/0x158 __dentry_kill+0x80/0x250 shrink_dentry_list+0x90/0x130 prune_dcache_sb+0x60/0x98 super_cache_scan+0xe8/0x190 do_shrink_slab+0x174/0x388 shrink_slab+0xd8/0x4c0 shrink_node+0x31c/0x908 do_try_to_free_pages+0xd0/0x508 try_to_free_pages+0x11c/0x238 __alloc_frozen_pages_noprof+0x4d0/0xdd0 __folio_alloc_noprof+0x18/0x70 __filemap_get_folio+0x248/0x440 ceph_readdir_prepopulate+0x570/0x9e8 mds_dispatch+0x1424/0x1ba0 ceph_con_process_message+0x74/0xa0 ceph_con_v1_try_read+0x3a0/0x1510 ceph_con_workfn+0x260/0x460
Enter a scoped NOFS allocation context and leave it after clearing journal_info. This prevents filesystem reclaim from recursing into another filesystem while the field contains Ceph-private data.
AnalysisAI
Denial of service (kernel crash/oops) in the Linux kernel CephFS client affects systems mounting a Ceph filesystem alongside another journaling filesystem such as ext4. The ceph handle_reply() path stores a ceph_mds_request pointer in current->journal_info while prepopulating the inode/dentry cache from an MDS reply; if an allocation in that window enters direct reclaim and prunes dentries from an ext4 mount, JBD2 misinterprets the Ceph pointer as a journal handle and dereferences r_tid as h_transaction, causing a paging fault and kernel oops. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a CephFS mount active on the host and the kernel CephFS client processing an MDS reply through ceph_readdir_prepopulate()/handle_reply() while current->journal_info holds a ceph_mds_request. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8) is inconsistent with the described behavior and should be treated as automated over-scoring: the description and the vendor tag both indicate a Denial Of Service (kernel crash), not confidentiality or integrity loss, and the trigger requires a Ceph filesystem to be mounted plus concurrent memory pressure driving direct reclaim into an ext4 shrinker - conditions that are environmental and non-deterministic rather than a clean remote unauthenticated exploit. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | On a host with both a mounted CephFS and an active ext4 filesystem, a CephFS client processes a large readdir reply from the MDS under memory pressure; a folio allocation in ceph_readdir_prepopulate() enters direct reclaim, the dcache shrinker prunes an ext4 dentry, and JBD2 dereferences the Ceph request pointer left in current->journal_info, crashing the kernel. A malicious or compromised MDS could raise the odds by returning large/complex replies to force allocations at the vulnerable moment, but no public exploit is identified and reliable triggering depends on reclaim timing. |
| Remediation | Vendor-released patch: upgrade to a fixed stable kernel - 6.18.46, 6.12.105, 6.6.153, 6.1.184, 5.15.217, or 5.10.266 (or mainline 7.1.10 / 7.2), matching your kernel series, via your distribution's updates. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all systems mounting Ceph filesystems and identify which co-mount other journaling filesystems (ext4 or similar). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today