CVE-2026-90042

A flaw was found in the Ceph filesystem client within the Linux kernel. This vulnerability arises from the improper handling of memory buffers during filename decryption, specifically when buffers are allocated in the vmalloc() region. This can lead to a kernel panic, causing the system to crash. A malicious Ceph server or a local user could potentially exploit this, resulting in a Denial of Service (DoS).

This vulnerability is assessed as having a Moderate severity for Red Hat Enterprise Linux because the defect is confined to causing a kernel denial of service, with no potential for privilege escalation or unauthorized data disclosure. In typical Red Hat deployments, the Ceph filesystem client module is not loaded by default and requires an explicit mount against a Ceph cluster utilizing filename encryption. Consequently, only systems actively mounting CephFS volumes under specific memory fragmentation conditions are exposed to kernel panics when decrypting directory entries.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.