CVE-2026-23201: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23201 Overview

A memory corruption vulnerability exists in the Linux kernel's CephFS subsystem within the parse_longname() function. The flaw causes a kernel oops (crash) when reading Ceph snapshot directories (.snap), triggered by operations as simple as running ls /mnt/my_ceph/.snap. The vulnerability stems from improper pointer handling where the str variable, guarded by __free(kfree), is advanced by one position to skip the initial underscore character in snapshot names. This pointer manipulation causes kfree() to be called with an invalid memory address, leading to system instability and potential denial of service.

Critical Impact

Systems using CephFS mounts with snapshot directories may experience kernel crashes and system hangs when accessing .snap directories, potentially causing service disruption in storage infrastructure environments.

Affected Products

• Linux Kernel (CephFS subsystem)
• Systems with CephFS mounts utilizing snapshot directories
• Enterprise storage systems using Ceph distributed storage

Discovery Timeline

• 2026-02-14 - CVE CVE-2026-23201 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-23201

Vulnerability Analysis

This vulnerability represents a memory management flaw in the Linux kernel's CephFS driver. The issue occurs during the parsing of snapshot directory names within the parse_longname() function. The CephFS implementation uses the kernel's __free(kfree) annotation for automatic memory management, which ensures that allocated memory is properly freed when it goes out of scope.

The root cause lies in how the code handles snapshot names that begin with an underscore character (_). When processing these names, the code advances the str pointer by one position to skip the leading underscore. However, this creates a critical inconsistency: the kfree() function is subsequently called with this modified pointer rather than the original allocation address.

In the Linux kernel memory allocator, freeing memory requires the exact pointer that was returned during allocation. When kfree() receives a pointer that has been arithmetically modified (pointer + 1), it attempts to free memory at an invalid location, triggering a kernel oops and potential system crash.

Root Cause

The vulnerability originates from a pointer arithmetic error combined with automatic memory management. The __free(kfree) macro associates the str pointer with automatic cleanup, but the subsequent str++ operation to skip the leading underscore modifies this pointer. When the cleanup runs, it passes the incremented pointer to kfree(), which expects the original allocation address. This mismatch causes heap corruption and triggers the kernel oops.

Attack Vector

The vulnerability can be triggered through local access to a CephFS mount point. An attacker or legitimate user with access to a CephFS filesystem can cause a denial of service by:

1. Mounting a CephFS volume with existing snapshots
2. Navigating to or listing the .snap directory
3. Triggering the parse_longname() function to process snapshot names

The reproduction steps documented in the vulnerability report indicate that simply listing a .snap directory containing multiple snapshots (e.g., 63 snapshots in the test case) is sufficient to trigger the kernel oops. The ls command hangs indefinitely while the kernel log displays the crash information.

Detection Methods for CVE-2026-23201

Indicators of Compromise

• Kernel oops messages in system logs referencing parse_longname() or CephFS snapshot handling
• System hangs or freezes when accessing .snap directories on CephFS mounts
• Processes stuck in uninterruptible sleep state (D state) when performing directory listings on Ceph snapshots
• Kernel panic or crash dumps indicating memory corruption in CephFS subsystem

Detection Strategies

• Monitor kernel logs (dmesg, /var/log/kern.log) for oops messages containing ceph, parse_longname, or kfree references
• Implement process monitoring to detect hung ls or directory enumeration commands on CephFS mount points
• Deploy kernel crash dump analysis (kdump) to capture and analyze crash events for CephFS-related memory corruption
• Use eBPF-based tracing tools to monitor kfree() calls with invalid pointers in the CephFS code path

Monitoring Recommendations

• Enable kernel oops notification and automatic crash reporting on systems with CephFS mounts
• Implement health checks for CephFS mount accessibility, including periodic .snap directory access tests in non-production environments
• Configure alerting on system log patterns indicating memory corruption or invalid free operations
• Monitor Ceph cluster health metrics alongside individual node kernel stability

How to Mitigate CVE-2026-23201

Immediate Actions Required

• Upgrade to a patched kernel version containing the fix for parse_longname() pointer handling
• Avoid accessing .snap directories on CephFS mounts until the patch is applied
• Review systems with CephFS mounts for signs of previous exploitation or crashes
• Schedule maintenance windows for kernel updates on systems running CephFS workloads

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix removes the need for advancing the str pointer, ensuring kfree() is called with the correct memory address. The following commits contain the fix:

• Kernel Git Commit #8c9af73
• Kernel Git Commit #bc8deda
• Kernel Git Commit #e258ed3

Apply the appropriate patch for your kernel version by updating through your distribution's package manager or by compiling from the patched kernel source.

Workarounds

• Restrict access to .snap directories using filesystem permissions or access control lists until patching is complete
• Unmount CephFS volumes that utilize snapshots on critical systems until the kernel is updated
• Implement monitoring to detect and alert on .snap directory access attempts
• Consider using alternative snapshot access methods or mounting snapshots as separate volumes if available

# Restrict .snap directory access as temporary mitigation
chmod 000 /mnt/cephfs/.snap

# Alternatively, unmount affected CephFS volume
umount /mnt/cephfs

# After patching, verify kernel version includes the fix
uname -r