CVE-2026-43420
Link Underflow in Ceph Linux Kernel
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ceph | ceph | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's Ceph filesystem implementation during an asynchronous unlink operation. The issue arises because the inode link count (`i_nlink`) is decremented before the unlink operation completes, under the assumption that the unlink will succeed. However, this can race with other client deletions or the completion of the unlink itself, potentially causing the `i_nlink` counter to underrun (go below zero), which is illegal and triggers a kernel warning.
Specifically, the unlink request is submitted asynchronously to the Metadata Server (MDS) without waiting for completion. Meanwhile, other operations may update the `i_nlink` counter to zero. If the unlink code then decrements it further, it causes an underrun and a warning. The fix involves skipping the decrement when the counter is already zero and protecting the update with a proper lock to avoid race conditions.
How can this vulnerability impact me? :
This vulnerability can cause kernel warnings and potentially unstable behavior in the Ceph filesystem due to illegal decrements of the inode link count. While it does not directly indicate data corruption or security breach, the race condition and warnings could lead to filesystem inconsistencies or unexpected errors during file unlink operations in environments using Ceph.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as a WARNING message in the Linux kernel logs related to the i_nlink counter underrun during async unlink operations in Ceph. To detect it, you should monitor your system logs for warnings similar to the following:
- WARNING: CPU: <cpu_id> PID: <pid> at fs/inode.c:407 drop_nlink+0x50/0x68
- Messages referencing ceph_unlink and drop_nlink functions in the call trace.
You can use commands like the following to search for such warnings in your system logs:
- sudo dmesg | grep -i 'drop_nlink'
- sudo journalctl -k | grep -i 'drop_nlink'
- sudo grep -r 'drop_nlink' /var/log/
These commands help identify kernel warnings related to the i_nlink underrun issue caused by async unlink in Ceph.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is caused by a race condition in the Ceph async unlink code that leads to an illegal decrement of the i_nlink counter. The fix involves skipping the decrement when the counter is already zero and protecting the update with the appropriate spinlock.
Immediate mitigation steps include:
- Update your Linux kernel to a version that includes the fix for this vulnerability, as it involves changes to the Ceph unlink handling code.
- Monitor your system logs for the WARNING messages indicating the issue to detect if the vulnerability is being triggered.
- Avoid forcing asynchronous unlink operations in Ceph until the fix is applied.
Since the issue is a race condition in kernel code, applying the patch or upgrading the kernel is the most reliable mitigation.