CVE-2026-90042: ceph: properly decrypt filenames in vmalloc() buffers
Published Sep 16, 2026
·Updated
ceph: properly decrypt filenames in vmalloc() buffers
Affected Software
1 affected component
Linux Kernel
Event History
Sep 16, 2026
CVE Published
via MITRE·10:33 AM
Data Sourced
via MITRE·10:33 AM
DescriptionSeverity
Data Sourced
via NVD·11:17 AM
DescriptionSeverity
Sep 17, 2026
Data Sourced
via Microsoft·08:05 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Under what conditions can this occur?
The issue occurs when Ceph messenger message buffers allocated with kvmalloc() are placed in the vmalloc() region because memory fragmentation prevents a sufficiently large kmalloc() allocation. Filename data from MDS messages can then be passed to fscrypt through buffers that are not in the required linear mapping region.
2
Which systems are most likely to show visible failures?
The reported result is kernel oopses, with failures noted especially on non-x86 platforms. Systems using Ceph with fscrypt filename decryption and experiencing the relevant vmalloc()-backed message allocations are the affected scenario.