CVE-2026-52961 Overview
CVE-2026-52961 is a Linux kernel vulnerability in the Ceph filesystem client. The flaw triggers a BUG_ON assertion in __ceph_build_xattrs_blob() at fs/ceph/xattr.c:918 due to a stale extended attribute (xattr) blob size calculation. The issue was introduced by commit d93231a6bc8a ("ceph: prevent a client from exceeding the MDS maximum xattr size"), which moved the required_blob_size computation before the __build_xattrs() call. This change created a race condition where the blob size becomes stale when i_ceph_lock is released and reacquired during execution. The generic/642 test case reproduces the kernel crash reliably.
Critical Impact
Local users with access to a Ceph-mounted filesystem can trigger a kernel BUG_ON panic, resulting in denial of service through kernel crash on affected Linux systems.
Affected Products
- Linux kernel with Ceph filesystem client (fs/ceph)
- Systems mounting CephFS volumes via the kernel client
- Kernel versions containing commit d93231a6bc8a prior to the fix
Discovery Timeline
- 2026-06-24 - CVE-2026-52961 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-52961
Vulnerability Analysis
The vulnerability is a race condition [Race Condition / TOCTOU] in the Linux kernel Ceph client's xattr handling code. When the kernel builds the xattr blob to send to the Metadata Server (MDS), it pre-computes required_blob_size before calling __build_xattrs(). However, __build_xattrs() temporarily releases i_ceph_lock during execution. During this window, a concurrent handle_cap_grant() callback from the MDS can update i_xattrs.blob with a newer blob and increment i_xattrs.version. When __ceph_build_xattrs_blob() resumes, the previously calculated size no longer matches the actual blob contents. The size mismatch triggers the BUG_ON assertion at fs/ceph/xattr.c:918, halting the kernel thread with an invalid opcode exception.
Root Cause
The root cause is improper lock retention across the xattr blob size computation and the blob construction. The commit d93231a6bc8a reordered operations so that the size is calculated under one lock acquisition but consumed after a lock-drop window. Kernel work queued by ceph-msgr (specifically handle_cap_grant) executes in this gap and mutates the xattr state, invalidating the cached size.
Attack Vector
Exploitation requires local access to a system using the CephFS kernel client. An attacker performing concurrent xattr operations while the MDS issues cap grants can trigger the race. The crash occurs in the ceph_con_workfn workqueue path during ceph_check_caps() → __prep_cap() → __ceph_build_xattrs_blob(). Because the panic results from a BUG_ON rather than memory corruption, the realistic impact is denial of service. No verified proof-of-concept code is published; the generic/642 fstest reproduces the issue.
No verified exploit code is available. See the kernel commit fixing the race for technical details of the patch.
Detection Methods for CVE-2026-52961
Indicators of Compromise
- Kernel panic messages referencing kernel BUG at fs/ceph/xattr.c:918
- Stack traces showing __ceph_build_xattrs_blob+0x1b8/0x1e0 followed by __prep_cap, ceph_check_caps, and handle_cap_grant
- Workqueue context ceph-msgr with ceph_con_workfn in the call trace
- Unexpected node reboots or hangs on CephFS clients during heavy metadata or xattr workloads
Detection Strategies
- Monitor dmesg and journalctl -k for the invalid opcode exception in the Ceph xattr path
- Track kernel crash dumps via kdump or crashkernel for matching RIP __ceph_build_xattrs_blob
- Correlate CephFS client crashes with MDS cap grant activity in ceph mds logs
Monitoring Recommendations
- Forward kernel logs from CephFS clients to a centralized log platform and alert on the fs/ceph/xattr.c BUG signature
- Track unplanned reboots of nodes running CephFS workloads, especially those running generic/642 or xfstests
- Inventory kernel versions across the fleet to identify hosts still running unpatched builds containing commit d93231a6bc8a
How to Mitigate CVE-2026-52961
Immediate Actions Required
- Apply the upstream kernel patches referenced in the stable tree once available from your Linux distribution
- Identify all hosts mounting CephFS via the kernel client and prioritize them for patching
- Reduce concurrent xattr operations on CephFS volumes until the patched kernel is deployed
Patch Information
The fix is committed in the Linux stable tree across multiple branches. Relevant commits include 0c22d9511cbd, 368d21ae9081, 7eb72425c4e3, and d5bd8b4e39cf. The fix recomputes required_blob_size after __build_xattrs() returns and i_ceph_lock is reacquired, ensuring the size reflects the current i_xattrs.blob state.
Workarounds
- Use the userspace ceph-fuse client instead of the kernel CephFS client where feasible
- Avoid workloads that generate large numbers of concurrent xattr updates on CephFS until the patch is applied
- Limit local user access on CephFS client hosts to reduce the risk of intentional race triggering
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
