« Volver al listado

CVE-2026-80528

Estado: RecibidaCrítica (9.8)—

In the Linux kernel, the following vulnerability has been resolved:

ceph: avoid fs reclaim while using current->journal_info

handle_reply() stores a `ceph_mds_request` pointer in `current->journal_info` while filling the inode and dentry cache from an MDS reply.

An allocation in this section can enter direct reclaim and prune dentries from another filesystem. If this dirties an ext4 inode, ext4 starts a JBD2 transaction. JBD2 interprets the Ceph request in `current->journal_info` as a journal handle and dereferences the request's `r_tid` as `h_transaction`, causing a kernel crash, e.g.:

Enter a scoped NOFS allocation context and leave it after clearing `journal_info`. This prevents filesystem reclaim from recursing into another filesystem while the field contains Ceph-private data.

Detalles técnicos trazas, registros y código del informe original
 Unable to handle kernel paging request at virtual address 00000000077b4818
 [...]
 Internal error: Oops: 0000000096000004 [#1]  SMP
 Modules linked in:
 CPU: 6 UID: 0 PID: 2699135 Comm: kworker/6:3 Tainted: G        W           6.18.38-i3 #1113 NONE
 [...]
 Workqueue: ceph-msgr ceph_con_workfn
 pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
 pc : jbd2__journal_start+0x2c/0x208
 lr : __ext4_journal_start_sb+0x100/0x178
 [...]
 Call trace:
  jbd2__journal_start+0x2c/0x208 (P)
  __ext4_journal_start_sb+0x100/0x178
  ext4_dirty_inode+0x3c/0x90
  __mark_inode_dirty+0x58/0x400
  iput.part.0+0x2b0/0x370
  iput+0x18/0x30
  dentry_unlink_inode+0xc0/0x158
  __dentry_kill+0x80/0x250
  shrink_dentry_list+0x90/0x130
  prune_dcache_sb+0x60/0x98
  super_cache_scan+0xe8/0x190
  do_shrink_slab+0x174/0x388
  shrink_slab+0xd8/0x4c0
  shrink_node+0x31c/0x908
  do_try_to_free_pages+0xd0/0x508
  try_to_free_pages+0x11c/0x238
  __alloc_frozen_pages_noprof+0x4d0/0xdd0
  __folio_alloc_noprof+0x18/0x70
  __filemap_get_folio+0x248/0x440
  ceph_readdir_prepopulate+0x570/0x9e8
  mds_dispatch+0x1424/0x1ba0
  ceph_con_process_message+0x74/0xa0
  ceph_con_v1_try_read+0x3a0/0x1510
  ceph_con_workfn+0x260/0x460

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad remota (AV:N, PR:N, UI:N) en kernel Linux explotable sin autenticación. El impacto primario es DoS por kernel crash; secundario, potencial escalada al ejecutarse con privilegios de kernel.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-80528",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "315f24088048a51eed341c53be66ea477a3c7d16",
              "lessThan": "ca5fa2380dd90a0adb01580fa6225025351a90f6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "315f24088048a51eed341c53be66ea477a3c7d16",
              "lessThan": "00c12f57a87f537fa8779258fb3a03003a99963e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "315f24088048a51eed341c53be66ea477a3c7d16",
              "lessThan": "4dbb2c02558e71f93510a6461d7e798b67426b49",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "315f24088048a51eed341c53be66ea477a3c7d16",
              "lessThan": "c8a21660c3b90864c391164eea5622e7b5b2897c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "315f24088048a51eed341c53be66ea477a3c7d16",
              "lessThan": "47b745747b3aa39064724a642884f9df924ddf20",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "315f24088048a51eed341c53be66ea477a3c7d16",
              "lessThan": "79d95b43ca090426399651ed580dd9bf2db36ab8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "315f24088048a51eed341c53be66ea477a3c7d16",
              "lessThan": "b6a0989613072499633e761a1536428a466de7d3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "315f24088048a51eed341c53be66ea477a3c7d16",
              "lessThan": "5b602344a49e039e792ce5a8923bcc61412ee134",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "fs/ceph/mds_client.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.6",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/ceph/mds_client.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-26T15:17:06.667",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/00c12f57a87f537fa8779258fb3a03003a99963e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/47b745747b3aa39064724a642884f9df924ddf20",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4dbb2c02558e71f93510a6461d7e798b67426b49",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5b602344a49e039e792ce5a8923bcc61412ee134",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/79d95b43ca090426399651ed580dd9bf2db36ab8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b6a0989613072499633e761a1536428a466de7d3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c8a21660c3b90864c391164eea5622e7b5b2897c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ca5fa2380dd90a0adb01580fa6225025351a90f6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: avoid fs reclaim while using current->journal_info\n\nhandle_reply() stores a `ceph_mds_request` pointer in\n`current->journal_info` while filling the inode and dentry cache from\nan MDS reply.\n\nAn allocation in this section can enter direct reclaim and prune\ndentries from another filesystem.  If this dirties an ext4 inode, ext4\nstarts a JBD2 transaction.  JBD2 interprets the Ceph request in\n`current->journal_info` as a journal handle and dereferences the\nrequest's `r_tid` as `h_transaction`, causing a kernel crash, e.g.:\n\n Unable to handle kernel paging request at virtual address 00000000077b4818\n [...]\n Internal error: Oops: 0000000096000004 [#1]  SMP\n Modules linked in:\n CPU: 6 UID: 0 PID: 2699135 Comm: kworker/6:3 Tainted: G        W           6.18.38-i3 #1113 NONE\n [...]\n Workqueue: ceph-msgr ceph_con_workfn\n pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : jbd2__journal_start+0x2c/0x208\n lr : __ext4_journal_start_sb+0x100/0x178\n [...]\n Call trace:\n  jbd2__journal_start+0x2c/0x208 (P)\n  __ext4_journal_start_sb+0x100/0x178\n  ext4_dirty_inode+0x3c/0x90\n  __mark_inode_dirty+0x58/0x400\n  iput.part.0+0x2b0/0x370\n  iput+0x18/0x30\n  dentry_unlink_inode+0xc0/0x158\n  __dentry_kill+0x80/0x250\n  shrink_dentry_list+0x90/0x130\n  prune_dcache_sb+0x60/0x98\n  super_cache_scan+0xe8/0x190\n  do_shrink_slab+0x174/0x388\n  shrink_slab+0xd8/0x4c0\n  shrink_node+0x31c/0x908\n  do_try_to_free_pages+0xd0/0x508\n  try_to_free_pages+0x11c/0x238\n  __alloc_frozen_pages_noprof+0x4d0/0xdd0\n  __folio_alloc_noprof+0x18/0x70\n  __filemap_get_folio+0x248/0x440\n  ceph_readdir_prepopulate+0x570/0x9e8\n  mds_dispatch+0x1424/0x1ba0\n  ceph_con_process_message+0x74/0xa0\n  ceph_con_v1_try_read+0x3a0/0x1510\n  ceph_con_workfn+0x260/0x460\n\nEnter a scoped NOFS allocation context and leave it after clearing\n`journal_info`.  This prevents filesystem reclaim from recursing into\nanother filesystem while the field contains Ceph-private data."
    }
  ],
  "lastModified": "2026-08-27T06:17:32.740",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}