CVE-2026-43419: Linux Kernel Memory Leak Vulnerability

CVE-2026-43419 Overview

CVE-2026-43419 is a memory leak vulnerability in the Linux kernel's Ceph distributed filesystem client. The flaw resides in the ceph_mdsc_build_path() function, where error code paths fail to release a path pointer allocated via __getname(). When ownership of the pointer is not transferred to the caller through path_info.path, the function returns without calling __putname(), leaking kernel memory.

The issue affects the Ceph Metadata Server (MDS) client code, which constructs filesystem path strings during metadata operations. Repeated invocation of the vulnerable error paths can exhaust kernel memory over time.

Critical Impact
Repeated triggering of error paths in ceph_mdsc_build_path() exhausts kernel slab memory, potentially leading to denial of service on systems mounting Ceph filesystems.

Affected Products

Linux kernel versions containing the vulnerable ceph_mdsc_build_path() implementation
Systems using the Ceph filesystem (ceph.ko) client module
Distributions shipping affected stable kernel branches prior to the upstream fix

Discovery Timeline

2026-05-08 - CVE-2026-43419 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-43419

Vulnerability Analysis

The vulnerability is a kernel memory leak [CWE-401] in the Ceph client component of the Linux kernel. The ceph_mdsc_build_path() function constructs a full pathname for inclusion in MDS requests by allocating a buffer through __getname(), which draws from the kernel's names_cachep slab cache.

During normal operation, the function returns the buffer pointer to the caller via path_info.path, transferring ownership and responsibility for freeing. However, multiple error handling branches return failure without releasing the buffer first. Each occurrence permanently consumes one entry in the names_cachep slab.

The fix adds the missing __putname() calls to those error paths, ensuring the buffer is freed whenever ownership does not pass to the caller. The corresponding upstream commits include 040d159a45de, 097cd68f4668, 13b8b9d6f59e, 5895d0164c84, and 657dc653b06a.

Root Cause

The root cause is missing cleanup logic in error handling branches. The function pairs __getname() allocation with conditional __putname() release, but several goto and early-return paths bypass the release call. This is a classic resource lifecycle bug where the success path correctly manages ownership transfer but error paths drop the reference without freeing.

Attack Vector

An attacker requires local access to a system mounting a Ceph filesystem to trigger the vulnerable code paths. Operations that cause ceph_mdsc_build_path() to fail repeatedly such as path construction against deleted, unlinked, or otherwise inconsistent inodes can drive memory consumption upward. Because the leak occurs in the kernel's slab allocator, recovery typically requires a reboot. No memory corruption or privilege escalation primitive has been identified for this flaw.

The vulnerability does not provide arbitrary code execution. The exploitation surface is limited to resource exhaustion against systems that mount Ceph and process attacker-influenced filesystem operations.

Detection Methods for CVE-2026-43419

Indicators of Compromise

Steady growth in the names_cache slab as reported by /proc/slabinfo on hosts mounting Ceph filesystems
Increasing SUnreclaim values in /proc/meminfo correlated with Ceph client activity
Kernel OOM killer events on long-running Ceph clients with no obvious user-space memory pressure

Detection Strategies

Monitor slab allocator statistics for unexplained growth in names_cache entries on Ceph client nodes
Correlate MDS request failures from dmesg and Ceph client logs with kernel memory consumption trends
Track kernel version inventory against the fixing commits to identify unpatched hosts

Monitoring Recommendations

Collect periodic snapshots of /proc/slabinfo and alert on sustained upward trends in names_cache
Forward kernel logs and Ceph mount diagnostics to a centralized analytics platform for trend analysis
Establish baseline memory profiles for Ceph client workloads and alert on deviations

How to Mitigate CVE-2026-43419

Immediate Actions Required

Identify all hosts running Linux kernels with the Ceph client module loaded (lsmod | grep ceph)
Apply distribution kernel updates that incorporate the upstream fix commits referenced in the advisory
Schedule reboots on affected hosts to load the patched kernel

Patch Information

The upstream fix adds __putname() calls to the error paths in ceph_mdsc_build_path(). The corresponding stable tree commits are available from kernel.org: Linux Kernel Commit 040d159, Linux Kernel Commit 097cd68, Linux Kernel Commit 13b8b9d, Linux Kernel Commit 5895d01, and Linux Kernel Commit 657dc65. Apply the vendor-provided kernel package for your distribution.

Workarounds

Unmount Ceph filesystems on hosts that do not require them until a patched kernel is available
Restart workloads or reboot hosts periodically to reclaim leaked slab memory as a temporary measure
Restrict local user access to systems mounting Ceph to reduce the surface that can repeatedly trigger error paths

bash

# Check whether the Ceph client module is loaded
lsmod | grep ceph

# Inspect names_cache slab utilization
grep names_cache /proc/slabinfo

# Verify running kernel version against patched releases
uname -r