CVE-2026-80527

A flaw was found in the Linux kernel's Ceph client. A reader can experience an indefinite hang when the client's local capability state (mds_wanted) becomes stale after a Metadata Server (MDS) capability revocation. This occurs because the client believes it still wants a capability (e.g., FILE_RD) that the MDS has revoked, and the update to reacquire it never reaches the MDS. Consequently, the reader waits indefinitely, leading to a Denial of Service (DoS) condition.

A MODERATE severity denial of service flaw was found in the Linux kernel CephFS client shipped in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. When the Ceph Metadata Server (MDS) revokes a client's FILE_RD capability, for example after another client performs a conflicting operation, the client's local mds_wanted state can still claim that the capability is already wanted. Because try_get_cap_refs() then sees the needed capability as already wanted, no new capability request is sent to the MDS, and a reader blocked in __ceph_get_caps() can wait indefinitely on i_cap_wq, hanging CephFS reads on that client until unrelated capability traffic happens to wake it. This is a timing-dependent state desynchronization with no confidentiality or integrity impact.

The kernel and kernel-rt components in Red Hat Enterprise Linux 8, 9, and 10 update streams, and the kernel and kernel-ivos-qualcomm components in Red Hat In-Vehicle OS 2, are affected, with the fix currently deferred to a future update. The residual risk on the deferred streams is a local denial of service against CephFS client reads, since a local user or another authenticated Ceph client performing conflicting operations can trigger the hang. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those streams.

Red Hat rates this flaw MODERATE (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the upstream CVEORG rating of 7.5 (IMPORTANT), because exploitation requires local access or an authenticated client on the Ceph cluster performing timing-dependent conflicting operations, and the impact is limited to the availability of the affected client.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.