CVE-2026-52962: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-52962 Overview

CVE-2026-52962 is a memory leak vulnerability in the Linux kernel's Ceph distributed filesystem client. The flaw resides in the __ceph_setxattr() function, where the old_blob variable can hold a reference to ci->i_xattrs.prealloc_blob during retry operations. The code path fails to invoke ceph_buffer_put() on old_blob, leaving the buffer reference uncounted and leaking memory on each occurrence.

The upstream Linux kernel maintainers have resolved this issue across multiple stable branches via several backported commits.

Critical Impact
Repeated extended attribute operations against a Ceph-mounted filesystem can exhaust kernel memory, leading to degraded performance or denial of service on affected systems.

Affected Products

Linux kernel — Ceph filesystem client (fs/ceph)
Multiple stable kernel branches receiving the backported fix
Systems mounting CephFS volumes via the in-kernel client

Discovery Timeline

2026-06-24 - CVE-2026-52962 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52962

Vulnerability Analysis

The vulnerability is a kernel memory leak [CWE-401] in the Ceph filesystem client's extended attribute (xattr) handling logic. When __ceph_setxattr() executes, it manages reference-counted ceph_buffer objects used to store xattr blobs. During retry paths in the function, the local old_blob pointer can be assigned the value of ci->i_xattrs.prealloc_blob. The corresponding ceph_buffer_put() call that would decrement the reference count and release the buffer is missing for this object.

Each unhandled retry causes a kernel buffer allocation to remain referenced indefinitely. Over time, repeated setxattr operations on inodes within a CephFS mount accumulate leaked buffers in kernel memory.

Root Cause

The root cause is a missing reference release in a retry code path. The old_blob variable temporarily stores the previously allocated prealloc_blob during reallocation, but the function returns without calling ceph_buffer_put(old_blob). The patch adds the missing release call to balance buffer reference counts.

Attack Vector

The vulnerability requires local access to a system mounting a CephFS volume and the ability to issue setxattr syscalls. An authenticated user repeatedly invoking xattr modifications on Ceph-backed files can gradually exhaust kernel memory. The impact is resource exhaustion rather than code execution or privilege escalation. The vulnerability is not known to be exploited in the wild, and no public proof-of-concept exists. The EPSS score is 0.184%.

No verified exploitation code is available. See the upstream commit at git.kernel.org commit 521e5aba for the technical fix details.

Detection Methods for CVE-2026-52962

Indicators of Compromise

Steady growth in kernel slab allocations attributable to ceph_buffer objects without corresponding frees.
Increasing memory pressure on hosts mounting CephFS that correlates with xattr workload patterns.
dmesg warnings or OOM events on long-running CephFS clients lacking the patch.

Detection Strategies

Track kernel slab usage with slabtop and watch for unbounded growth in Ceph-related caches.
Audit running kernel versions on CephFS clients against the patched commits listed in the upstream advisory.
Correlate setxattr syscall volume with kernel memory consumption trends to surface anomalous leak behavior.

Monitoring Recommendations

Forward kernel memory metrics (/proc/meminfo, /proc/slabinfo) to a centralized telemetry pipeline for trend analysis.
Alert on sustained kernel memory growth on CephFS client nodes, especially file servers and container hosts.
Maintain a software bill of materials for kernel builds across the fleet to identify hosts still running pre-patch versions.

How to Mitigate CVE-2026-52962

Immediate Actions Required

Identify all hosts running an unpatched Linux kernel with the Ceph client compiled in or loadable.
Apply the vendor-supplied kernel update containing the ceph_buffer_put() fix for old_blob in __ceph_setxattr().
Schedule reboots for hosts where live kernel patching is not available to load the corrected kernel.

Patch Information

The fix has been merged into the mainline Linux kernel and backported across stable branches. Reference commits include 3fa13cee, 4bfdcefd, 521e5aba, 5d3cc36b, 7d3e8d2d, bc7abce4, d0cb9946, and ecf94823. Consume the fix through your Linux distribution's standard kernel update channel.

Workarounds

Restrict local users on CephFS clients to limit the ability to issue high-volume setxattr operations.
Periodically reboot or fail over long-running CephFS clients until patches are applied to reclaim leaked memory.
Where feasible, mount affected datasets via alternative means until the kernel update is deployed.

bash

# Verify the running kernel version on CephFS client hosts
uname -r

# Check distribution package manager for available kernel updates
# Debian/Ubuntu
apt list --upgradable | grep linux-image

# RHEL/CentOS/Fedora
dnf check-update kernel