CVE-2026-23047

A deadlock vulnerability was found in the Linux kernel's Ceph client library (libceph). The calc_target() function clears the paused flag for requests but never sets it for linger requests, as that logic was only in __submit_request(). When watch requests are paused long enough to timeout and need reestablishment, they never get marked as paused and thus never get resent when unpaused. This causes rbd_reregister_watch() to wait indefinitely with rbd_dev->watch_mutex held.

This vulnerability affects systems using Ceph RBD (RADOS Block Device) storage. When network conditions cause watch requests to be paused for extended periods, the subsequent deadlock prevents RBD images from being unmapped, causing "rbd unmap" commands to hang in D state. Recovery requires a system reboot.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.