CVE-2026-52960: Linux Kernel Privilege Escalation Flaw

CVE-2026-52960 is a privilege escalation vulnerability in the Linux kernel affecting the ceph filesystem component. The flaw involves improper folio reference handling during writeback operations. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-52960 Overview

CVE-2026-52960 is a memory management vulnerability in the Linux kernel's ceph filesystem client. The flaw exists in the writeback path, where folios retrieved through filemap_get_folios are not properly released when they are removed from the batch as unsuitable for writeback. Because the batch holds folio references that would normally be released through folio_batch_release, the missing folio_put call leaks references on each affected folio. The issue was reproduced on Linux kernel v6.18.

Critical Impact
Repeated writeback activity against a Ceph-mounted filesystem can leak folio references, leading to resource exhaustion and degraded system stability on affected Linux hosts.

Affected Products

Linux kernel ceph client filesystem
Linux kernel v6.18 (confirmed test target)
Systems mounting CephFS through the in-kernel client

Discovery Timeline

2026-06-24 - CVE-2026-52960 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52960

Vulnerability Analysis

The Linux kernel ceph client uses folio batches to manage page cache entries during writeback. The function filemap_get_folios populates a batch with elevated references on each folio, and the batch is later released through folio_batch_release. The writeback routine inspects each folio and removes entries that are not suitable for writeback from the batch. Removing a folio from the batch detaches it from the eventual folio_batch_release cleanup, but the original reference taken by filemap_get_folios is not dropped. Each skipped folio therefore leaks one reference. This is a reference-counting [CWE-401] style resource leak in kernel memory management, not a direct memory corruption issue.

Root Cause

The root cause is a missing folio_put call in the ceph writeback path after removing folios from the batch. The code path assumed batch release would clean up all references, but folios removed from the batch are no longer covered by that release.

Attack Vector

The vulnerability is triggered through normal writeback activity against a CephFS mount when folios in the page cache are determined to be unsuitable for writeback. Repeated triggering causes folio references to accumulate, which can pin pages in memory and contribute to resource exhaustion. No specific remote attack vector or privilege escalation primitive is documented in the upstream advisory.

No verified public exploit code is available. The fix is described in the upstream commits referenced under Kernel Commit 544576f Fix and Kernel Commit 86921e8 Update.

Detection Methods for CVE-2026-52960

Indicators of Compromise

Steady growth in kernel page cache reference counts on hosts mounting CephFS without a corresponding workload increase.
Memory pressure events, oom-killer activity, or reclaim stalls on long-running Ceph clients.
Unexpected pinned-folio counts visible through /proc/meminfo and slab accounting.

Detection Strategies

Compare running kernel uname -r output against vendor advisories that incorporate commits 544576f0f05c and 86921e890fe1.
Track CephFS writeback metrics over time and alert on monotonic increases in cached or pinned pages that do not align with workload.
Use ftrace or bpftrace to instrument ceph writeback functions and observe folio reference imbalance.

Monitoring Recommendations

Monitor kernel logs for memory reclaim, allocation failures, and CephFS-related warnings.
Track per-host memory utilization trends on CephFS clients and correlate against I/O activity.
Maintain inventory of kernel versions across Linux fleets to identify hosts still running unpatched builds such as v6.18.

How to Mitigate CVE-2026-52960

Immediate Actions Required

Identify all Linux hosts mounting CephFS through the in-kernel client and record their kernel versions.
Apply the stable kernel update containing the fix referenced in Kernel Commit 544576f Fix.
Schedule reboots for affected hosts to load the patched kernel image.

Patch Information

The upstream fix adds the missing folio_put call so that folios removed from the writeback batch have their filemap_get_folios reference dropped. The change is captured in two stable kernel commits: 544576f0f05c4a759806acddfaaeb686f14fb4b0 and 86921e890fe1dea9791fb70bec552516fd47716a. Distributions shipping Linux v6.18 or related stable branches will pick up the fix through their normal kernel update channels.

Workarounds

Where patching is delayed, periodically remount or fail over CephFS clients to release accumulated cached state.
Use FUSE-based ceph-fuse clients instead of the in-kernel client on hosts where applying a kernel update is not yet possible.
Constrain memory-sensitive workloads on unpatched CephFS clients and monitor for reclaim pressure.

bash

# Verify running kernel and check for the patched commits in distro changelog
uname -r
rpm -q --changelog kernel | grep -E '544576f0f05c|86921e890fe1'
# Debian/Ubuntu equivalent
apt changelog linux-image-$(uname -r) | grep -E '544576f0f05c|86921e890fe1'