CVE-2026-80528

A flaw was found in the Linux kernel's Ceph filesystem. When the kernel handles replies and fills inode and dentry caches, a memory allocation can trigger a memory reclamation process. This process can incorrectly interpret Ceph-specific data as a journal handle if it interacts with another filesystem, such as ext4. This misinterpretation ultimately leads to a kernel crash, resulting in a Denial of Service (DoS) for the system.

Ceph MDS reply handling temporarily stores a Ceph request pointer in current journal_info while filling inode and dentry cache. An allocation in this section can enter direct reclaim and run shrinkers from another filesystem. If ext4 dirties an inode during that reclaim path, JBD2 may interpret the Ceph request as a journal handle and dereference request fields as JBD2 state, leading to an invalid pointer dereference and kernel crash. For the CVSS the PR:L is used because reliable triggering normally requires a local process or service workload that accesses the mounted Ceph filesystem and causes MDS replies to be processed. The issue is network adjacent in typical Ceph deployments because a malicious or compromised MDS path can influence replies, but practical exploitation depends on an already mounted Ceph filesystem and memory reclaim timing. Impact is at least denial of service via kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.