CVE-2026-46052
BaseFortify
Publication date: 2026-05-27
Last updated on: 2026-05-27
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ceph | ceph | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's Ceph filesystem code. It occurs because Ceph can call the function d_add() on a negative dentry (a directory entry that does not exist) that is already present in the primary dcache hash. The d_add() function is not safe to call on dentries that are already hashed because it reinserts the dentry into a hash bucket unconditionally, which can corrupt the bucket and create a self-loop.
This corruption causes the __d_lookup() function to potentially spin forever while walking the hash list, leading to a CPU stall and triggering RCU (Read-Copy-Update) stall reports. The issue arises because Ceph incorrectly assumes that a negative dentry is always unhashed and calls d_add() without checking, which can corrupt the internal data structures of the filesystem cache.
The fix involves changing the Ceph code to only call d_add() on negative dentries if they are actually unhashed, preventing the reinsertion of already hashed dentries and avoiding corruption.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to enter an infinite loop during filesystem operations involving Ceph, leading to CPU stalls and degraded system performance.
Specifically, the corruption of the dcache hash bucket can cause the kernel to hang or become unresponsive due to the infinite loop in the __d_lookup() function. This can impact system stability and availability, potentially causing denial of service conditions on systems using Ceph.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can manifest as a kernel issue where the system experiences an RCU stall due to a corrupted dentry hash list. Symptoms include kernel logs showing messages like "rcu: INFO: rcu_sched self-detected stall on CPU" and processes spinning indefinitely in __d_lookup().
To detect this vulnerability, you should monitor your kernel logs (e.g., using dmesg or journalctl) for RCU stall reports and related stack traces involving __d_lookup and d_add functions.
Suggested commands to check for signs of this issue include:
- dmesg | grep -i 'rcu_sched self-detected stall'
- journalctl -k | grep -i 'rcu_sched self-detected stall'
- Check for high CPU usage or stuck processes related to Ceph clients or php-cgi processes that might be triggering the issue.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation is to update the Linux kernel to a version that includes the fix for this vulnerability, which ensures that d_add() is only called on negative dentries when they are unhashed, preventing d_hash list corruption.
Until the kernel is updated, consider the following steps:
- Avoid workloads or operations that heavily use Ceph lookups or atomic_open calls that might trigger reuse of hashed negative dentries.
- Monitor kernel logs for RCU stall messages and be prepared to reboot affected systems if they become unresponsive due to this issue.
- Engage with your Linux distribution or Ceph vendor to obtain patches or backported fixes if available.