Linux Kernel CephFS EUVD-2026-28725

The host must be acting as a CephFS client - the ceph kernel module loaded and a CephFS filesystem mounted - since the vulnerable code is ceph_mdsc_build_path() in the Ceph MDS client. An attacker needs a local, authenticated low-privileged account (PR:L, AV:L) and must repeatedly drive filesystem operations down the error paths that previously failed to call __putname(), leaking a name buffer each time until kernel memory is exhausted. LIMITING FACTORS: no remote vector (local only), authentication required, exposure is confined to systems that actually mount CephFS (not default on most deployments), the impact is availability only (no data exposure or code execution), and a single leak is small - practical DoS requires sustained repeated triggering.

This is a genuinely medium/low-priority issue, not a high-CVSS scare. The CVSS 3.1 base score is 5.5 (medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H: exploitation is local, requires an authenticated low-privileged account (PR:L), and the only impact is availability (A:H) - there is no confidentiality or integrity impact (C:N/I:N). The flaw is a kernel memory leak (CWE-401) in the CephFS client's ceph_mdsc_build_path(), so repeated triggering of the unfixed error paths slowly exhausts kernel memory, a denial-of-service rather than code execution or data theft. EPSS is 0.02% (5th percentile), i.e. essentially no modeled likelihood of exploitation, and the vulnerability is NOT on the CISA KEV list, so there is no confirmed active exploitation. No public exploit code is identified - the supplied references are stable-kernel patch commits and vendor advisories, not working exploit code. The vuln.today decision label is 'this_month', consistent with a real but non-emergency DoS. CONFLICT TO NOTE: the input Tags include 'Information Disclosure', but the CVSS vector sets C:N (no confidentiality impact) and the CWE is a memory leak with A:H - this tag contradicts the authoritative impact metrics and should not drive triage; treat this as an availability/DoS issue, not info disclosure.

A local, low-privileged user on a Linux host that mounts a CephFS filesystem performs file operations that repeatedly hit the error code paths in ceph_mdsc_build_path(), each failure leaking the name buffer obtained via __getname(). Sustained over time this exhausts kernel memory and degrades or crashes the system (denial of service). No public exploit code is identified at time of analysis; the available references are patch commits and vendor advisories.