CVE-2026-46052: ceph: only d_add() negative dentries when they are unhashed
ceph: only dadd() negative dentries when they are unhashed
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1 - Configuration
Apply the fix in fs/ceph/dir.c at both ceph_lookup() and ceph_finish_lookup() call sites: avoid calling d_add(dentry, NULL) for a negative dentry that is already hashed; preserve current behavior for unhashed negative dentries by only calling d_add() when d_unhashed(dn) is true, preventing __d_lookup() / __d_rehash() from corrupting the dcache hash bucket and spinning forever.
Linux kernel (fs/ceph/dir.c) d_add() handling for negative dentries = Only call d_add(dentry, NULL) when d_unhashed(dn) (do not call d_add for already-hashed negative dentries)
Event History
Frequently Asked Questions
What is the practical impact of successful exploitation?
The issue can corrupt a VFS dcache hash bucket and cause __d_lookup() to spin indefinitely. This can lead to CPU stalls and RCU stall reports, resulting in a high availability impact without affecting confidentiality or integrity.
Does exploitation require authentication or user interaction?
No. The supplied CVSS vector specifies network attack vector, low attack complexity, no privileges required, and no user interaction required.
How can administrators identify a potentially affected system?
Look for RCU self-detected stall reports and processes stuck in __d_lookup(). The reported behavior may include a CPU repeatedly looping during dcache lookup after a corrupted hash bucket creates a self-loop.