CVE-2026-80527 (GCVE-0-2026-80527)
Vulnerability from cvelistv5
Published
2026-08-26 14:37
Modified
2026-08-27 05:01
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix hanging __ceph_get_caps() with stale mds_wanted
A reader can hang forever in __ceph_get_caps() when the client no
longer holds `FILE_RD`, but local cap state still says that the
capability is already wanted (via `mds_wanted`).
One way to trigger this is through MDS cap revocation. If another
client performs a conflicting operation, the MDS can revoke `FILE_RD`
from the reader; the next read then has to reacquire `FILE_RD`. If
the cap update that should request `FILE_RD` never reaches the MDS
after `cap->mds_wanted` was raised, the reader is left holding only
non-file caps while local `mds_wanted` still includes the file read
caps.
In that state, try_get_cap_refs() sees `need <= mds_wanted` and
returns 0, so __ceph_get_caps() just waits on `i_cap_wq`. If the cap
update that was supposed to request `FILE_RD never reaches the MDS
after `cap->mds_wanted was` raised, no further request is sent and the
waiter can sleep indefinitely until unrelated cap traffic happens to
wake it up.
The ordering issue is that `cap->mds_wanted` is updated in
__prep_cap() before the `CEPH_MSG_CLIENT_CAPS message` is actually
queued for send. That makes one field serve two different meanings at
once: what this client wants, and what the client believes the MDS
already knows it wants.
A proper fix would be to split those states and track whether a cap
update is actually in flight or has been observed by the MDS.
However, simply moving the `cap->mds_wanted assignment` later would
not be sufficient: queueing the message in the messenger does not
guarantee that the MDS processed that specific wanted set, and
reconnect or message loss can still invalidate that assumption.
Fixing that properly would require a larger rework of the cap state
machine.
To allow simpler backports to stable kernels, this patch implements a
simpler workaround:
- stop waiting forever in __ceph_get_caps(); after a bounded wait,
fall back to the renew path
- make ceph_renew_caps() issue a synchronous `OPEN` request whenever
the inode still does not actually hold the wanted caps, instead of
only calling ceph_check_caps()
The extra issued-vs-wanted check in ceph_renew_caps() is necessary
because the previous test only checked whether the inode still had any
real caps at all. That is not enough after revocation: the client can
still hold something like `pLs` and yet be missing `FILE_RD`
completely. In that case, falling back to ceph_check_caps() is not
sufficient, because it still trusts `cap->mds_wanted` and may resend
nothing. By requiring `(issued & wanted) == wanted` before taking the
asynchronous path, the code only uses ceph_check_caps() when the
`wanted caps` are already actually issued. Otherwise, it sends the
synchronous `OPEN` renew.
This preserves the existing asynchronous fast path when the wanted
caps are already issued, avoids changing cap-state semantics, and
fixes the hang by guaranteeing that a stalled waiter eventually
retries through a path that does not rely on the stale `mds_wanted`
state.
[ idryomov: move CEPH_GET_CAPS_WAIT_TIMEOUT from libceph.h to
mds_client.h, formatting ]
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c Version: 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c Version: 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c Version: 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c Version: 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c Version: 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c Version: 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c Version: 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ceph/caps.c",
"fs/ceph/file.c",
"fs/ceph/mds_client.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b5661524c5a45085a866864ca9b8ae2513dfd67a",
"status": "affected",
"version": "0a454bdd501ad1aa30bb72e9581efa338ad6ce5c",
"versionType": "git"
},
{
"lessThan": "5e84bc6f67e19fdd192d8b215de728acbfc12572",
"status": "affected",
"version": "0a454bdd501ad1aa30bb72e9581efa338ad6ce5c",
"versionType": "git"
},
{
"lessThan": "5fedf279a1ea369d39c8b06dd4547cdc576065d0",
"status": "affected",
"version": "0a454bdd501ad1aa30bb72e9581efa338ad6ce5c",
"versionType": "git"
},
{
"lessThan": "e05c315b4da0c16ea800ee4b2cb6c617f586d1b5",
"status": "affected",
"version": "0a454bdd501ad1aa30bb72e9581efa338ad6ce5c",
"versionType": "git"
},
{
"lessThan": "fcce1b3be6d286aa80831e730289f4c062053ae6",
"status": "affected",
"version": "0a454bdd501ad1aa30bb72e9581efa338ad6ce5c",
"versionType": "git"
},
{
"lessThan": "a3bc6b3e9ef3f5f5cb85a902a30a090c7931127c",
"status": "affected",
"version": "0a454bdd501ad1aa30bb72e9581efa338ad6ce5c",
"versionType": "git"
},
{
"lessThan": "9e55fe24c548ad3163903eb58bb002d28d32a630",
"status": "affected",
"version": "0a454bdd501ad1aa30bb72e9581efa338ad6ce5c",
"versionType": "git"
},
{
"lessThan": "50958bb928bad3bdba9e5d1b7ff4bbadcf6951e6",
"status": "affected",
"version": "0a454bdd501ad1aa30bb72e9581efa338ad6ce5c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ceph/caps.c",
"fs/ceph/file.c",
"fs/ceph/mds_client.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix hanging __ceph_get_caps() with stale mds_wanted\n\nA reader can hang forever in __ceph_get_caps() when the client no\nlonger holds `FILE_RD`, but local cap state still says that the\ncapability is already wanted (via `mds_wanted`).\n\nOne way to trigger this is through MDS cap revocation. If another\nclient performs a conflicting operation, the MDS can revoke `FILE_RD`\nfrom the reader; the next read then has to reacquire `FILE_RD`. If\nthe cap update that should request `FILE_RD` never reaches the MDS\nafter `cap-\u003emds_wanted` was raised, the reader is left holding only\nnon-file caps while local `mds_wanted` still includes the file read\ncaps.\n\nIn that state, try_get_cap_refs() sees `need \u003c= mds_wanted` and\nreturns 0, so __ceph_get_caps() just waits on `i_cap_wq`. If the cap\nupdate that was supposed to request `FILE_RD never reaches the MDS\nafter `cap-\u003emds_wanted was` raised, no further request is sent and the\nwaiter can sleep indefinitely until unrelated cap traffic happens to\nwake it up.\n\nThe ordering issue is that `cap-\u003emds_wanted` is updated in\n__prep_cap() before the `CEPH_MSG_CLIENT_CAPS message` is actually\nqueued for send. That makes one field serve two different meanings at\nonce: what this client wants, and what the client believes the MDS\nalready knows it wants.\n\nA proper fix would be to split those states and track whether a cap\nupdate is actually in flight or has been observed by the MDS.\nHowever, simply moving the `cap-\u003emds_wanted assignment` later would\nnot be sufficient: queueing the message in the messenger does not\nguarantee that the MDS processed that specific wanted set, and\nreconnect or message loss can still invalidate that assumption.\nFixing that properly would require a larger rework of the cap state\nmachine.\n\nTo allow simpler backports to stable kernels, this patch implements a\nsimpler workaround:\n\n- stop waiting forever in __ceph_get_caps(); after a bounded wait,\n fall back to the renew path\n\n- make ceph_renew_caps() issue a synchronous `OPEN` request whenever\n the inode still does not actually hold the wanted caps, instead of\n only calling ceph_check_caps()\n\nThe extra issued-vs-wanted check in ceph_renew_caps() is necessary\nbecause the previous test only checked whether the inode still had any\nreal caps at all. That is not enough after revocation: the client can\nstill hold something like `pLs` and yet be missing `FILE_RD`\ncompletely. In that case, falling back to ceph_check_caps() is not\nsufficient, because it still trusts `cap-\u003emds_wanted` and may resend\nnothing. By requiring `(issued \u0026 wanted) == wanted` before taking the\nasynchronous path, the code only uses ceph_check_caps() when the\n`wanted caps` are already actually issued. Otherwise, it sends the\nsynchronous `OPEN` renew.\n\nThis preserves the existing asynchronous fast path when the wanted\ncaps are already issued, avoids changing cap-state semantics, and\nfixes the hang by guaranteeing that a stalled waiter eventually\nretries through a path that does not rely on the stale `mds_wanted`\nstate.\n\n[ idryomov: move CEPH_GET_CAPS_WAIT_TIMEOUT from libceph.h to\n mds_client.h, formatting ]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - On nodes with cephfs mounted (common in Ceph/Rook/Kubernetes), a remote Ceph client can perform conflicting writes so the MDS revokes FILE_RD via CEPH_MSG_CLIENT_CAPS over the network; the victim kernel then hits the stale mds_wanted hang on the next VFS read/mmap/ioctl path into __ceph_get_caps().\nAC:L - The fix commit documents MDS cap revocation from another client as a reliable trigger; an attacker controls both sides by holding a second Ceph client session and driving conflicting I/O and reconnect/message-loss timing, without depending on uncontrollable victim heap layout or rare kernel configs.\nPR:N - Exploitation requires no Linux account, capability, or init-namespace root on the victim host; any remote (or co-tenant) Ceph client with write access to the shared file can induce revocation and the hang while victims only perform normal reads on an already-mounted cephfs export.\nUI:N - No interactive victim action is needed beyond routine automated reads on cephfs-backed workloads; the attacker does not require the victim to mount media, click a link, or perform a one-off administrative step at exploitation time.\nS:U - Impact is confined to threads blocked in __ceph_get_caps() on the same host kernel security domain; it does not cross VM, container, or IOMMU boundaries or grant elevated privileges beyond availability loss on the affected client.\nC:N - This is a capability wait-loop logic error with no out-of-bounds access, use-after-free, or information disclosure; stale mds_wanted only prevents cap reacquisition and does not read or leak kernel or file data to an attacker.\nI:N - The bug does not modify inode data, kernel memory, or capabilities; it causes indefinite sleeping in cap acquisition with no path to arbitrary write, metadata corruption, or code execution.\nA:H - Before the fix, __ceph_get_caps() could wait forever on i_cap_wq when mds_wanted falsely indicated FILE_RD was already requested but not issued, hanging the reader thread (read/write/mmap/getattr) until unrelated cap traffic; repeated exploitation can deny service to cephfs-backed applications."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T05:01:22.018Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b5661524c5a45085a866864ca9b8ae2513dfd67a"
},
{
"url": "https://git.kernel.org/stable/c/5e84bc6f67e19fdd192d8b215de728acbfc12572"
},
{
"url": "https://git.kernel.org/stable/c/5fedf279a1ea369d39c8b06dd4547cdc576065d0"
},
{
"url": "https://git.kernel.org/stable/c/e05c315b4da0c16ea800ee4b2cb6c617f586d1b5"
},
{
"url": "https://git.kernel.org/stable/c/fcce1b3be6d286aa80831e730289f4c062053ae6"
},
{
"url": "https://git.kernel.org/stable/c/a3bc6b3e9ef3f5f5cb85a902a30a090c7931127c"
},
{
"url": "https://git.kernel.org/stable/c/9e55fe24c548ad3163903eb58bb002d28d32a630"
},
{
"url": "https://git.kernel.org/stable/c/50958bb928bad3bdba9e5d1b7ff4bbadcf6951e6"
}
],
"title": "ceph: fix hanging __ceph_get_caps() with stale mds_wanted",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80527",
"datePublished": "2026-08-26T14:37:06.178Z",
"dateReserved": "2026-08-26T14:34:25.764Z",
"dateUpdated": "2026-08-27T05:01:22.018Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…