ceph: avoid fs reclaim while using current->journal_info
In the Linux kernel, the following vulnerability has been resolved: ceph: avoid fs reclaim while using current->journal_info handle_reply() stores a `ceph_mds_request` pointer in `current->journal_info` while filling the inode and dentry cache from an MDS reply. An allocation in this section can enter direct reclaim and prune dentries from another filesystem. If this dirties an ext4 inode, ext4 starts a JBD2 transaction. JBD2 interprets the Ceph request in `current->journal_info` as a journal handle and dereferences the request's `r_tid` as `h_transaction`, causing a kernel crash, e.g.: Unable to handle kernel paging request at virtual address 00000000077b4818 [...] Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 6 UID: 0 PID: 2699135 Comm: kworker/6:3 Tainted: G W 6.18.38-i3 #1113 NONE [...] Workqueue: ceph-msgr ceph_con_workfn pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : jbd2__journal_start+0x2c/0x208 lr : __ext4_journal_start_sb+0x100/0x178 [...] Call trace: jbd2__journal_start+0x2c/0x208 (P) __ext4_journal_start_sb+0x100/0x178 ext4_dirty_inode+0x3c/0x90 __mark_inode_dirty+0x58/0x400 iput.part.0+0x2b0/0x370 iput+0x18/0x30 dentry_unlink_inode+0xc0/0x158 __dentry_kill+0x80/0x250 shrink_dentry_list+0x90/0x130 prune_dcache_sb+0x60/0x98 super_cache_scan+0xe8/0x190 do_shrink_slab+0x174/0x388 shrink_slab+0xd8/0x4c0 shrink_node+0x31c/0x908 do_try_to_free_pages+0xd0/0x508 try_to_free_pages+0x11c/0x238 __alloc_frozen_pages_noprof+0x4d0
CVE-2026-80528
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-80528
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "315f24088048a51eed341c53be66ea477a3c7d16",
"lessThan": "ca5fa2380dd90a0adb01580fa6225025351a90f6",
"versionType": "git"
},
{
"status": "affected",
"version": "315f24088048a51eed341c53be66ea477a3c7d16",
"lessThan": "00c12f57a87f537fa8779258fb3a03003a99963e",
"versionType": "git"
},
{
"status": "affected",
"version": "315f24088048a51eed341c53be66ea477a3c7d16",
"lessThan": "4dbb2c02558e71f93510a6461d7e798b67426b49",
"versionType": "git"
},
{
"status": "affected",
"version": "315f24088048a51eed341c53be66ea477a3c7d16",
"lessThan": "c8a21660c3b90864c391164eea5622e7b5b2897c",
"versionType": "git"
},
{
"status": "affected",
"version": "315f24088048a51eed341c53be66ea477a3c7d16",
"lessThan": "47b745747b3aa39064724a642884f9df924ddf20",
"versionType": "git"
},
{
"status": "affected",
"version": "315f24088048a51eed341c53be66ea477a3c7d16",
"lessThan": "79d95b43ca090426399651ed580dd9bf2db36ab8",
"versionType": "git"
},
{
"status": "affected",
"version": "315f24088048a51eed341c53be66ea477a3c7d16",
"lessThan": "b6a0989613072499633e761a1536428a466de7d3",
"versionType": "git"
},
{
"status": "affected",
"version": "315f24088048a51eed341c53be66ea477a3c7d16",
"lessThan": "5b602344a49e039e792ce5a8923bcc61412ee134",
"versionType": "git"
}
],
"programFiles": [
"fs/ceph/mds_client.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.6",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/ceph/mds_client.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-80528
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #34311 · Revision 1
- Added to Heist Feed
- Publisher date