Skip to main content

Linux Kernel EUVDEUVD-2026-32434

| CVE-2026-46052 HIGH
2026-05-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-vjcv-x2xf-6m7h
Information Disclosure Linux Dell Amd
7.5
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Gain local access to CephFS mount
  2. Delivery
    Repeatedly stat nonexistent paths in directory with shared caps
  3. Exploit
    Reuse cached negative dentry through ceph_lookup/ceph_finish_lookup
  4. Install
    d_add re-inserts already-hashed node
  5. C2
    hlist_bl bucket self-loop forms
  6. Execute
    __d_lookup spins under RCU read
  7. Impact
    CPU stall and partial system DoS

Vulnerability Assessment

Exploitation Conditions

Triggering requires the target system to mount a CephFS filesystem using the in-kernel ceph client (fs/ceph), and the attacker (or workload) must be able to perform path lookups - stat, open, or equivalent - against that mount. The bug fires specifically when a negative dentry that is already hashed in the dcache is handed to one of two Ceph paths: ceph_finish_lookup() processing an MDS reply of ENOENT with no trace, or ceph_lookup() taking the local-ENOENT fast path that requires the parent directory to be complete and hold shared caps. Limiting factors: hosts not running CephFS are not exposed at all; the CVSS AV:N label is misleading because exploitation in practice requires local syscall access to the mount rather than raw remote network reach; impact is bounded to availability (CPU stall / soft-lockup) with no confidentiality or integrity loss; and no authentication is required beyond whatever lets the user issue lookups on the mount, which on most deployments means any local user with read/traverse access.
Impact

Real-world risk is materially lower than the 7.5 CVSS score implies. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) encodes a network, unauthenticated, high-availability impact, but the description and call trace make clear that triggering the bug requires issuing local filesystem syscalls (newfstatat in the captured stall) against a mounted CephFS - i.e. the 'network' label reflects that CephFS speaks to a remote MDS, not that an unauthenticated network attacker can reach the bug directly. EPSS of 0.02% (5th percentile) is consistent with a kernel-internal race that requires specific filesystem state (reused cached negative dentries on a CephFS mount with shared caps or an MDS ENOENT-no-trace reply). This is NOT on CISA KEV and no public exploit identified at time of analysis. Conflict to flag: CVSS attack vector (N) versus practical local-trigger pattern in the description - defenders should treat this as a local DoS on systems mounting CephFS, not a remote internet-facing risk. Priority is moderate for fleets running CephFS at scale (the reporter hit it organically and lost a CPU to an RCU stall), low elsewhere.
Exploit ScenarioDerived

On a host with a CephFS mount, an unprivileged local process repeatedly stats or opens nonexistent filenames in a directory whose negative dentries are reused and re-resolved by ceph_lookup()/ceph_finish_lookup(), causing an already-hashed negative dentry to be re-added to the dcache hash bucket. The resulting self-loop traps __d_lookup() in an infinite RCU read-side walk, pinning a CPU and emitting rcu_sched stall warnings as observed in the reporter's php-cgi workload. No public exploit identified at time of analysis; the original report is an organic production reproduction rather than a weaponized PoC.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 30, 2026

Denial of service in the Linux kernel Ceph client allows local users with access to a Ceph-mounted filesystem to trigger d_hash list corruption and RCU stalls by inducing path lookups against reused cached negative dentries. The flaw stems from fs/ceph/dir.c calling d_add(dentry, NULL) on already-hashed negative dentries, creating self-loops in the hlist_bl bucket that cause __d_lookup() to spin indefinitely. EPSS is 0.02% (5th percentile) and no public exploit identified at time of analysis, but the bug has been reproduced organically in production (RCU stall on a Dell PowerEdge R7615 running 6.18.17).

RemediationAI

Vendor-released patch: upgrade to Linux 7.1-rc1 or the backported stable releases 7.0.4, 6.18.27, 6.12.86, or 6.6.140 (per ENISA EUVD-2026-32434). Distribution kernels should pull the corresponding stable backport commits 2010cb06b9df7d3c816c78358c566bdacbdf38ff, 83ce43a21bb7df8dd52228afdd918d2d058eefde, 4179cc390dacebc87079419ec92f86f3dc46294d, 803447f93d75ab6e40c85e6d12b5630d281d70d6, and b91e535f208c48a5e7464f1aa38338a30e7912df from https://git.kernel.org/stable/. If you cannot patch immediately, the only effective compensating control is to avoid the vulnerable code path by unmounting CephFS or switching affected workloads off the kernel CephFS client to the FUSE client (ceph-fuse), accepting the performance cost; restricting which workloads stat paths on CephFS reduces exposure but does not eliminate it because any stat/open against a directory with cached negative dentries can hit the bug. Blocking unprivileged mounts of CephFS on multi-tenant hosts limits which users can introduce the vulnerable state.

Affected VersionsENISA

Linux 2817b000b02c5f0c05af67c01fb2684e1381d6ef <2010cb06b9df7d3c816c78358c566bdacbdf38ff
Linux patch: 7.1-rc1
Linux patch: 6.6.140
Linux 2817b000b02c5f0c05af67c01fb2684e1381d6ef <83ce43a21bb7df8dd52228afdd918d2d058eefde
Linux 2.6.34
Linux 2817b000b02c5f0c05af67c01fb2684e1381d6ef <4179cc390dacebc87079419ec92f86f3dc46294d
Linux patch: 0
Linux patch: 7.0.4
Linux patch: 6.12.86
Linux patch: 6.18.27
Linux 2817b000b02c5f0c05af67c01fb2684e1381d6ef <803447f93d75ab6e40c85e6d12b5630d281d70d6
Linux 2817b000b02c5f0c05af67c01fb2684e1381d6ef <b91e535f208c48a5e7464f1aa38338a30e7912df

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The issue lives in the kernel CephFS client (fs/ceph/dir.c), which interacts with the VFS dcache (directory entry cache). Negative dentries - cached lookup results for names that do not exist - are normally added via d_add(), which routes through __d_add() and __d_rehash() and unconditionally reinserts the dentry's hash node into the per-bucket hlist_bl. Reinserting a node that is still linked corrupts the bucket and can create a self-loop, after which lockless RCU readers in __d_lookup() walk the list forever. Two Ceph code paths violate the 'only hash if unhashed' invariant: ceph_finish_lookup() when the MDS returns ENOENT with no trace, and ceph_lookup() on the local-ENOENT fast path for a complete directory with shared caps. A sibling path, ceph_fill_trace(), already gates its d_add(dn, NULL) call on d_unhashed(dn), confirming the intended pattern. The fix mirrors that guard in both offending sites. The root cause is a state-management bug (improper handling of an already-initialized resource) rather than a memory-safety class issue; no CWE was assigned in the input.

Know when Dell gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE HIGH
Red Hat 7.0 MEDIUM

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
May 30, 2026 - 11:22 NVD
7.5 (HIGH)
Patch available
May 27, 2026 - 19:46 EUVD
CVE Published
May 27, 2026 - 14:17 nvd
UNKNOWN (no severity yet)
CVE Published
May 27, 2026 - 14:17 nvd
HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ceph: only d_add() negative dentries when they are unhashed

Ceph can call d_add(dentry, NULL) on a negative dentry that is already present in the primary dcache hash.

In the current VFS that is not safe. d_add() goes through __d_add() to __d_rehash(), which unconditionally reinserts dentry->d_hash into the hlist_bl bucket. If the dentry is already hashed, reinserting the same node can corrupt the bucket, including creating a self-loop. Once that happens, __d_lookup() can spin forever in the hlist_bl walk, typically looping only on the d_name.hash mismatch check and eventually triggering RCU stall reports like this one:

rcu: INFO: rcu_sched self-detected stall on CPU rcu: 87-....: (2100 ticks this GP) idle=3a4c/1/0x4000000000000000 softirq=25003319/25003319 fqs=829 rcu: (t=2101 jiffies g=79058445 q=698988 ncpus=192) CPU: 87 UID: 2952868916 PID: 3933303 Comm: php-cgi8.3 Not tainted 6.18.17-i1-amd #950 NONE Hardware name: Dell Inc. PowerEdge R7615/0G9DHV, BIOS 1.6.6 09/22/2023 RIP: 0010:__d_lookup+0x46/0xb0 Code: c1 e8 07 48 8d 04 c2 48 8b 00 49 89 fc 49 89 f5 48 89 c3 48 83 e3 fe 48 83 f8 01 77 0f eb 2d 0f 1f 44 00 00 48 8b 1b 48 85 db <74> 20 39 6b 18 75 f3 48 8d 7b 78 e8 ba 85 d0 00 4c 39 63 10 74 1f RSP: 0018:ff745a70c8253898 EFLAGS: 00000282 RAX: ff26e470054cb208 RBX: ff26e470054cb208 RCX: 000000006e958966 RDX: ff26e48267340000 RSI: ff745a70c82539b0 RDI: ff26e458f74655c0 RBP: 000000006e958966 R08: 0000000000000180 R09: 9cd08d909b919a89 R10: ff26e458f74655c0 R11: 0000000000000000 R12: ff26e458f74655c0 R13: ff745a70c82539b0 R14: d0d0d0d0d0d0d0d0 R15: 2f2f2f2f2f2f2f2f FS: 00007f5770896980(0000) GS:ff26e482c5d88000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5764de50c0 CR3: 000000a72abb5001 CR4: 0000000000771ef0 PKRU: 55555554 Call Trace: <TASK> lookup_fast+0x9f/0x100 walk_component+0x1f/0x150 link_path_walk+0x20e/0x3d0 path_lookupat+0x68/0x180 filename_lookup+0xdc/0x1e0 vfs_statx+0x6c/0x140 vfs_fstatat+0x67/0xa0 __do_sys_newfstatat+0x24/0x60 do_syscall_64+0x6a/0x230 entry_SYSCALL_64_after_hwframe+0x76/0x7e

This is reachable with reused cached negative dentries. A Ceph lookup or atomic_open can be handed a negative dentry that is already hashed, and fs/ceph/dir.c then hits one of two paths that incorrectly assume "negative" also means "unhashed":

  • ceph_finish_lookup():

MDS reply is -ENOENT with no trace -> d_add(dentry, NULL)

  • ceph_lookup():

local ENOENT fast path for a complete directory with shared caps -> d_add(dentry, NULL)

Both paths can therefore re-add an already-hashed negative dentry.

Ceph already uses the correct pattern elsewhere: ceph_fill_trace() only calls d_add(dn, NULL) for a negative null-dentry reply when d_unhashed(dn) is true.

Fix both fs/ceph/dir.c sites the same way: only call d_add() for a negative dentry when it is actually unhashed. If the negative dentry is already hashed, leave it in place and reuse it as-is.

This preserves the existing behavior for unhashed dentries while avoiding d_hash list corruption for reused hashed negatives.

Executive ViewAI

Why It Matters

CVE-2026-46052 affects the Linux kernel Ceph client and enables local denial of service attacks causing system crashes and service interruptions on production infrastructure. The vulnerability has been confirmed reproducing in production environments (RCU stalls on Dell PowerEdge servers), directly threatening availability of Ceph-dependent storage infrastructure. Organizations using Ceph for distributed storage require immediate remediation to prevent service outages.

Business Impact: High
Compensating Controls

Apply vendor patch. Prior to full deployment, restrict local user access to Ceph-mounted filesystems to trusted administrators only, and implement kernel monitoring for RCU stalls and filesystem-related panics as exploitation indicators.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Dell

View all
CVE-2012-2962 MEDIUM POC
6.5 Jul 30

SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2

CVE-2014-8420 CRITICAL POC
9.0 Nov 25

The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before
CVE-2012-3951 HIGH POC
7.5 Jul 31

The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwor
CVE-2014-4977 MEDIUM POC
6.5 Jul 16

Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute

CVE-2026-22769 CRITICAL
10.0 Feb 17

Dell RecoverPoint for Virtual Machines prior to 6.0.3.1 HF1 contains hardcoded credentials (CVE-2026-22769, CVSS 10.0) t
CVE-2014-125113 CRITICAL POC
9.3 Aug 05

An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance vers
CVE-2012-2626 MEDIUM POC
5.0 Jul 31

cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not requir
CVE-2014-8272 MEDIUM POC
5.0 Dec 19

The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57

CVE-2016-9683 CRITICAL POC
9.8 Feb 22

The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerabili
CVE-2016-9682 CRITICAL POC
9.8 Feb 22

The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to two Remote Command Injection vulnerabi
CVE-2016-9684 CRITICAL POC
9.8 Feb 22

The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerabili
CVE-2017-10955 HIGH
8.8 Oct 19

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8488-1 ADVISORY https://ubuntu.com/security/notices/USN-8489-1 ADVISORY https://vuldb.com/vuln/366281 REF https://git.kernel.org/stable/c/2010cb06b9df7d3c816c78358c566bdacbdf38ff REF https://git.kernel.org/stable/c/4147ae08824cc8b65d2b2018f79d416af2937108 REF https://git.kernel.org/stable/c/4179cc390dacebc87079419ec92f86f3dc46294d REF https://git.kernel.org/stable/c/73b47a1f06dee5e61b00dee5227d75d3f1f6d977 REF https://git.kernel.org/stable/c/79ffcbeac6bc1dc1bcdb0434acf250f6215ec111 REF https://git.kernel.org/stable/c/803447f93d75ab6e40c85e6d12b5630d281d70d6 REF https://git.kernel.org/stable/c/83ce43a21bb7df8dd52228afdd918d2d058eefde REF https://git.kernel.org/stable/c/b91e535f208c48a5e7464f1aa38338a30e7912df

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy