CVE-2026-52961

A flaw was found in the Linux kernel's Ceph filesystem component. A race condition exists in the __ceph_build_xattrs_blob() function where the required extended attribute (xattr) blob size is computed before the __build_xattrs() call. During this window, another process can update the xattr blob, leading to a stale size calculation. This can result in a kernel crash, causing a Denial of Service (DoS) to the system.

This vulnerability is rated as Moderate severity because exploitation requires an active Ceph filesystem mount and is limited to causing a local denial of service via a kernel crash, without compromising confidentiality or integrity. Standard Red Hat Enterprise Linux configurations do not mount CephFS by default, restricting exposure to systems explicitly configured to use the kernel Ceph client. A local user with access to an active Ceph mount can trigger a race condition during concurrent extended attribute modifications, resulting in a kernel panic that disrupts system availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.