CVE-2026-64112

A flaw was found in the Linux kernel's Rados Block Device (RBD) module. A race condition exists in the lock_dwork draining mechanism during the unmapping of an image. This allows the lock_dwork to be re-queued after it is expected to be finalized, potentially leading to rbd_acquire_lock() executing on freed or reset resources. This can result in a violated assertion within the kernel, causing system instability or a denial of service.

A race in the RBD unmap path can let lock_dwork be requeued while exclusive lock work is being drained. This can allow rbd_acquire_lock and follow up lock handling to run after rbd_dev_device_release and rbd_dev_image_release have freed or reset image resources, creating a plausible use-after-free condition or kernel crash. For the CVSS the PR:L is used in the paranoid score because reliable triggering may be possible by a local user or service account with delegated RBD map or unmap control, even though typical systems restrict this path to root or CAP_SYS_ADMIN. The issue is not directly network reachable because the trigger is local RBD device control rather than incoming Ceph traffic, although backend network timing may influence the race window. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to use-after-free in kernel workqueue context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.