CVE-2026-52961: Linux Kernel Ceph Filesystem Race Condition Causing Kernel Panic

Technical summary

CVE-2026-52961 is a BUG_ON condition in __ceph_build_xattrs_blob() within fs/ceph/xattr.c caused by a race condition between required_blob_size calculation and blob content updates. Commit d93231a6bc8a moved size computation before __build_xattrs(), which releases and reacquires i_ceph_lock. During this window, handle_cap_grant() may update i_xattrs.blob with MDS-provided data and increment i_xattrs.version. When __build_xattrs() reacquires the lock, the stale required_blob_size value no longer matches the current blob state, causing the BUG_ON assertion at line 918 to trigger. The vulnerability is classified as CWE-617 (Reachable Assertion) and reproducible via the generic/642 test case.

Business impact

Production systems running Ceph clients on affected Linux kernel versions face denial-of-service risk through kernel panics during normal file operations. For organizations relying on Ceph for clustered storage, virtualization backends, or container orchestration (Kubernetes with Ceph RBD), this can cause unexpected node reboots and service interruption. The CVSS 5.5 MEDIUM score reflects local-only access requirement and lack of confidentiality/integrity breach, but the availability impact is complete.

Affected systems

The vulnerability affects Linux kernel implementations with Ceph filesystem support. Impact is limited to systems with Ceph client functionality enabled, particularly those performing extended attribute operations under concurrent workloads. Affected systems include: servers using CephFS for shared storage, Kubernetes nodes with RBD block storage, OpenStack instances leveraging Ceph backend, and hybrid cloud environments combining local and Ceph-backed filesystems. The race condition is triggered during specific file operation sequences reproducible in test environments.

Exploitability

Exploitability is moderate. The vulnerability requires local system access and the ability to trigger concurrent file operations with extended attributes on a Ceph-mounted filesystem. No remote exploitation path exists. The race condition is timing-dependent but reproducible via the generic/642 test case, suggesting it can occur under realistic I/O patterns. Privilege escalation is not required; a standard user performing filesystem operations can trigger the crash. The kernel panic qualifies as a denial-of-service condition rather than privilege escalation or data theft.

Remediation

Apply a kernel update that includes the fix for this race condition. The fix involves serializing the required_blob_size calculation with blob updates or repositioning the size computation to occur after __build_xattrs() completes with proper locking. Verify the specific kernel version or patch addresses the i_ceph_lock race between required_blob_size and i_xattrs.version updates. Temporary mitigation includes reducing extended attribute usage or redistributing Ceph workloads to unaffected kernel versions pending patches.

Patch guidance

Update the Linux kernel to a patched version that resolves the i_ceph_lock race condition in xattr handling. Consult your Linux distribution (RHEL, Ubuntu, Debian, etc.) for specific kernel version numbers and availability. Test patches in a non-production Ceph environment first, as kernel updates may affect I/O performance or compatibility with other subsystems. If using Ceph in production, coordinate patching with your storage team to avoid simultaneous node reboots. Verify against the vendor advisory that the patch includes the fix to __ceph_build_xattrs_blob() race condition logic.

Detection guidance

Monitor kernel logs for BUG_ON messages originating from fs/ceph/xattr.c:918 or generic oops traces involving __ceph_build_xattrs_blob. Systems experiencing this bug will show crash logs with 'invalid opcode' and a call stack through ceph_handle_caps→handle_cap_grant→__prep_cap. Use kernel instrumentation (kprobes, eBPF) to log i_xattrs.version changes relative to required_blob_size calculations if deeper diagnosis is needed. Correlate crashes with extended attribute operations or capability grant messages from MDS servers.

Why prioritize this

While the CVSS score is MEDIUM (5.5), this vulnerability should be prioritized for patch deployment because: (1) it causes kernel panics affecting service availability in production Ceph deployments, (2) it is triggered by normal filesystem operations without special privileges, (3) reproducibility via standard test cases suggests real-world triggering is likely under load, and (4) Ceph is increasingly used in cloud-native and distributed storage architectures where node stability is critical. Organizations relying on Ceph should treat this as HIGH priority for testing and deployment.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects: Attack Vector Local (requires local system access), Attack Complexity Low (race condition is readily triggered), Privileges Required Low (standard user can cause crash), User Interaction None, Scope Unchanged (impact confined to affected system), Confidentiality None (no data exposure), Integrity None (no data corruption), and Availability High (kernel panic). The score accurately captures the DoS impact but may underweight the practical severity in Ceph-dependent infrastructure where node availability is paramount.

Frequently asked questions