CVE-2026-52960

A flaw was found in the Linux kernel's Ceph component. This vulnerability occurs due to improper handling of memory pages, known as folios, that are not suitable for writeback. When certain folios are removed, their references are not properly released, leading to a resource leak. A local attacker could potentially exploit this to cause resource exhaustion, resulting in a Denial of Service (DoS).

This vulnerability is rated with a Low severity because exploiting it requires an unprivileged local user to perform writeback-related file operations against an active Ceph filesystem, resulting only in memory reference leakage without compromising confidentiality, integrity, or granting elevated privileges. Standard Red Hat Enterprise Linux deployments do not enable or mount CephFS by default, restricting exposure to hosts explicitly configured to use the kernel Ceph client. In environments where CephFS is mounted, the flaw presents a limited denial-of-service risk through gradual kernel memory exhaustion over time.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.