CVE-2026-52960: Linux Kernel Ceph Writeback Memory Leak (CVSS 7.5)

Technical summary

CVE-2026-52960 addresses a reference counting error in the Linux kernel's Ceph filesystem implementation. The vulnerability occurs in folio batch handling during writeback operations. When unsuitable folios are removed from a batch (obtained via filemap_get_folios), the corresponding folio_put() calls are missing. Since folio_batch_release maintains references to folios in the batch, failure to decrement these references on removal causes memory leaks. This was identified and tested on kernel v6.18.

Business impact

Organizations running Ceph-backed storage clusters or Linux systems with Ceph clients face potential denial-of-service risk. A memory leak in the writeback path can degrade system performance, trigger out-of-memory conditions, and cause service interruption. Affected systems may experience unresponsive behavior, forced reboots, or loss of access to Ceph storage. In multi-tenant or cloud environments, this could impact multiple workloads.

Affected systems

The Linux kernel is affected, specifically in its Ceph filesystem support. Systems actively using Ceph for distributed storage, including Linux servers, container orchestration platforms, and cloud deployments that depend on Ceph, are at risk. The vulnerability affects kernel versions including v6.18 and potentially earlier versions where the faulty code path exists.

Exploitability

This is a kernel memory leak vulnerability with no authentication or user interaction required. Any legitimate I/O workload that triggers writeback of unsuitable folios can gradually exhaust memory. The CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects the network-accessible, low-complexity nature of triggering the affected code path. However, consistent exploitation requires sustained writeback activity; it is not a single-packet remote code execution vector.

Remediation

Apply a patched Linux kernel version that includes the folio reference count fix. Verify the specific patch commit in the Linux kernel repository and confirm it is included in your distribution's kernel update. Until patching is complete, monitor Ceph-backed systems for memory pressure and unexpected OOM events. Restart affected services if memory exhaustion occurs.

Patch guidance

Consult your Linux distribution's security advisories and kernel update channels for the patched version that resolves CVE-2026-52960. Verify the fix against the Linux kernel git repository to confirm the commit includes the folio_put() correction in the Ceph writeback code path. Test the patched kernel in a non-production environment before rolling out to production Ceph clusters. Coordinate patches with any Ceph-specific kernel modules or out-of-tree drivers your organization may maintain.

Detection guidance

Monitor kernel logs for memory pressure warnings, elevated page fault rates, or OOM killer events on systems running Ceph. Track memory utilization trends on Ceph clients and servers; sustained unexplained growth suggests the leak. Use tools like 'slabtop' and 'memstat' to identify pinned memory pools. Enable kernel memory accounting (via cgroups or memcg) to isolate Ceph-related memory consumption. Correlate spikes with heavy Ceph writeback activity.

Why prioritize this

This vulnerability merits prompt attention due to its HIGH severity score, the lack of authentication barriers, and its ability to silently degrade system stability. Ceph deployments often underpin critical infrastructure; a memory leak in the filesystem can have cascading effects. However, it requires sustained writeback activity to manifest noticeably, so organizations without active Ceph I/O may see delayed impact.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible vulnerability with low attack complexity and no privilege or interaction requirements. The vector emphasizes availability impact (A:H) with no confidentiality or integrity compromise. The score does not account for the operational reality that consistent exploitation requires sustained I/O; however, in production Ceph environments, such workloads are common, justifying the elevated rating.

Frequently asked questions