Към съдържанието
Търсене

CVE-2026-80527: Linux

7.5

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

  • Експлоатация: няма данни за експлоатация
  • Атаката може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: ceph: fix hanging __ceph_get_caps() with stale mds_wanted A reader can hang forever in __ceph_get_caps() when the client no longer holds `FILE_RD`, but local cap state still says that the capability is already wanted (via `mds_wanted`). One way to trigger this is through MDS cap revocation. If another client performs a conflicting operation, the MDS can revoke `FILE_RD` from the reader; the next read then has to reacquire `FILE_RD`. If the cap update that should request `FILE_RD` never reaches the MDS after `cap->mds_wanted` was raised, the reader is left holding only non-file caps while local `mds_wanted` still includes the file read caps. In that state, try_get_cap_refs() sees `need <= mds_wanted` and returns 0, so __ceph_get_caps() just waits on `i_cap_wq`. If the cap update that was supposed to request `FILE_RD never reaches the MDS after `cap->mds_wanted was` raised, no further request is sent and the waiter can sleep indefinitely until unrelated cap traffic happens to wake it up. The ordering issue is that `cap->mds_wanted` is updated in __prep_cap() before the `CEPH_MSG_CLIENT_CAPS message` is actually queued for send. That makes one field serve two different meanings at once: what this client wants, and what the client believes the MDS already knows it wants. A proper fix would be to split those states and track whether a cap update is actually in flight or has been observed by the MDS. However, simply moving the `cap->mds_wanted assignment` later would not be sufficient: queueing the message in the messenger does not guarantee that the MDS processed that specific wanted set, and reconnect or message loss can still invalidate that assumption. Fixing that properly would require a larger rework of the cap state machine. To allow simpler backports to stable kernels, this patch implements a simpler workaround: - stop waiting forever in __ceph_get_caps(); after a bounded wait, fall

Засегнати продукти

  • Linux Linux: 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c преди b5661524c5a45085a866864ca9b8ae2513dfd67a; 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c преди 5e84bc6f67e19fdd192d8b215de728acbfc12572; 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c преди 5fedf279a1ea369d39c8b06dd4547cdc576065d0; 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c преди e05c315b4da0c16ea800ee4b2cb6c617f586d1b5; 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c преди fcce1b3be6d286aa80831e730289f4c062053ae6; 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c преди a3bc6b3e9ef3f5f5cb85a902a30a090c7931127c; 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c преди 9e55fe24c548ad3163903eb58bb002d28d32a630; 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c преди 50958bb928bad3bdba9e5d1b7ff4bbadcf6951e6
  • Linux Linux: 5.8; преди 5.8; 5.10.266 до 5.10.*; 5.15.217 до 5.15.*; 6.1.184 до 6.1.*; 6.6.153 до 6.6.*; 6.12.105 до 6.12.*; 6.18.46 до 6.18.*; 7.1.10 до 7.1.*; 7.2 до *

История

  • 26 август 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2026-80527: Linux | freedomonline.bg