CVE-2026-89648

In the Linux kernel, the following vulnerability has been resolved: ceph: cap delegated inode count in cephparsedeleginos cephparsedeleginos decodes interval sets of delegated inode numbers from an MDS create-with-delegation reply. For each set it reads a 64-bit start and a 64-bit len with...

CVE-2026-89647

In the Linux kernel, the following vulnerability has been resolved: ceph: do not repeat cephtrimdentries if no progress possible cephcapreclaimwork re-queues itself for as long as cephtrimdentries returns -EAGAIN, which happens whenever a lease walk exhausts its nrtoscan budget. This creates a bu...

CVE-2026-89647 ceph: do not repeat ceph_trim_dentries() if no progress possible

In the Linux kernel, the following vulnerability has been resolved: ceph: do not repeat cephtrimdentries if no progress possible cephcapreclaimwork re-queues itself for as long as cephtrimdentries returns -EAGAIN, which happens whenever a lease walk exhausts its nrtoscan budget. This creates a bu...

CVE-2026-89647 ceph: do not repeat ceph_trim_dentries() if no progress possible

In the Linux kernel, the following vulnerability has been resolved: ceph: do not repeat cephtrimdentries if no progress possible cephcapreclaimwork re-queues itself for as long as cephtrimdentries returns -EAGAIN, which happens whenever a lease walk exhausts its nrtoscan budget. This creates a bu...

EUVD-2026-76559

In the Linux kernel, the following vulnerability has been resolved: ceph: do not repeat cephtrimdentries if no progress possible cephcapreclaimwork re-queues itself for as long as cephtrimdentries returns -EAGAIN, which happens whenever a lease walk exhausts its nrtoscan budget. This creates a bu...

CVE-2026-89647

CVE-2026-89647 affects the Linux kernel's Ceph file system . The function ceph_cap_reclaim_work() enters a busy loop by re-queuing itself whenever ceph_trim_dentries() returns -EAGAIN, which occurs when a lease walk exhausts its scan budget with no cap pressure and all leases still valid. The dir...

CVE-2026-89646

CVE-2026-89646 is a leaked inode reference bug in the Ceph filesystem component of the Linux kernel. When a writeback is aborted during unmount (because ceph_inc_osd_stopping_blocker() fails), the ihold() taken by ceph_dirty_folio() is never released via writepages_finish(), so i_wrbuffer_ref nev...

CVE-2026-89646 ceph: fix leaked inode reference on writeback abort at umount

In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount cephdirtyfolio takes a wrbuffer claim on each newly dirtied folio: it bumps iwrbufferref taking an ihold on the 0-1 transition and attaches the snapcontext to...

CVE-2026-89646 ceph: fix leaked inode reference on writeback abort at umount

In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount cephdirtyfolio takes a wrbuffer claim on each newly dirtied folio: it bumps iwrbufferref taking an ihold on the 0-1 transition and attaches the snapcontext to...

EUVD-2026-76558

In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount cephdirtyfolio takes a wrbuffer claim on each newly dirtied folio: it bumps iwrbufferref taking an ihold on the 0-1 transition and attaches the snapcontext to...

CVE-2026-89646

In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount cephdirtyfolio takes a wrbuffer claim on each newly dirtied folio: it bumps iwrbufferref taking an ihold on the 0-1 transition and attaches the snapcontext to...

PT-2026-90368

In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS export get name ceph get name copies the MDS-supplied name into the caller's NAME MAX-sized buffer with memcpyname, rinfo-dname, rinfo-dname len and then writes namerinfo-dname len = 0...

PT-2026-90369

In the Linux kernel, the following vulnerability has been resolved: ceph: reject export targets ranks = CEPH MAX MDS in mdsmap decode MDSMap export targets entries are monitor controlled. check new map uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespa...

PT-2026-90367

In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fs name decode in handle session handle session decodes the MDSCapAuth records carried by a CEPH SESSION OPEN message msg version = 6. For each record the match.path and match.fs name byte strings...

PT-2026-90371

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in kick flushing caps on cf entry freed during unlock list for each entry iterates ci-i cap flush list but drops i ceph lock to send cap messages. During the unlock window, handle cap flush ack can acquire i ceph...

PT-2026-90362

In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount ceph dirty folio takes a wrbuffer claim on each newly dirtied folio: it bumps i wrbuffer ref taking an ihold on the 0-1 transition and attaches the snap context to...

PT-2026-90363

In the Linux kernel, the following vulnerability has been resolved: ceph: do not repeat ceph trim dentries if no progress possible ceph cap reclaim work re-queues itself for as long as ceph trim dentries returns -EAGAIN, which happens whenever a lease walk exhausts its nr to scan budget. This...

PT-2026-90364

In the Linux kernel, the following vulnerability has been resolved: ceph: cap delegated inode count in ceph parse deleg inos ceph parse deleg inos decodes interval sets of delegated inode numbers from an MDS create-with-delegation reply. For each set it reads a 64-bit start and a 64-bit len with...

PT-2026-90370

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in check new map on session freed during unlock check new map iterates mdsc-sessions and for each active session drops mdsc-mutex to perform per-session operations. The forced-close path rank removed from map...

PT-2026-90366

In the Linux kernel, the following vulnerability has been resolved: ceph: bound num export targets array for mds info v2/v3 ceph mdsmap decode in fs/ceph/mdsmap.c reads num export targets from each per-mds info record and advances the decode cursor by num export targets sizeofu32 without first...