CVE-2026-80528 Overview
CVE-2026-80528 is a Linux kernel vulnerability in the Ceph filesystem client. The flaw allows filesystem reclaim to recurse into another filesystem while current->journal_info still holds a Ceph-private pointer. When JBD2 interprets this pointer as an ext4 journal handle, it dereferences invalid memory and triggers a kernel oops.
The bug occurs during handle_reply() processing of Metadata Server (MDS) replies, where allocations can enter direct reclaim and prune dentries belonging to ext4. The resolution introduces a scoped NOFS allocation context to block cross-filesystem reclaim while journal_info contains non-journal data.
Critical Impact
A crafted or coincidental memory pressure event during Ceph MDS reply handling can crash the kernel, causing denial of service on hosts mounting CephFS alongside ext4.
Affected Products
- Linux kernel with CephFS client (fs/ceph) prior to the fix commits
- Systems mounting CephFS together with journaled filesystems such as ext4 using JBD2
- Stable kernel branches receiving the referenced backport commits
Discovery Timeline
- 2026-08-26 - CVE-2026-80528 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-80528
Vulnerability Analysis
The defect lies in the CephFS client's use of the per-task current->journal_info field. During handle_reply(), the Ceph client stores a ceph_mds_request pointer in this field while it populates the inode and dentry caches from an MDS response. The kernel reserves journal_info for journaling filesystems, so any other subsystem that reads it will misinterpret the contents.
Memory allocations inside ceph_readdir_prepopulate() can trigger direct reclaim. Reclaim calls prune_dcache_sb(), which may evict dentries from unrelated filesystems. When the evicted dentry belongs to ext4 and dirties an inode, ext4_dirty_inode() calls __ext4_journal_start_sb(). JBD2 then dereferences current->journal_info as a journal_handle, treating the request's r_tid field as h_transaction, and faults on an invalid address.
Root Cause
The root cause is unsafe reuse of a kernel-wide per-task field for filesystem-private state without preventing cross-filesystem reentrancy. Ceph did not mask reclaim through memalloc_nofs_save() before storing the request pointer, allowing another filesystem's transaction path to observe stale data.
Attack Vector
Exploitation requires a Ceph client under memory pressure while processing MDS replies on a host that also mounts ext4. A local or remote workload that induces dentry cache churn during Ceph directory operations can deterministically reach the fault path. Result is a kernel oops in jbd2__journal_start, terminating the workqueue thread and rendering the system unstable.
The upstream fix wraps the affected section with memalloc_nofs_save() and memalloc_nofs_restore(), and clears journal_info before leaving the scope. See the technical references for patch commits including Kernel Git Commit 00c12f57 and Kernel Git Commit ca5fa238.
Detection Methods for CVE-2026-80528
Indicators of Compromise
- Kernel oops messages referencing jbd2__journal_start in the call trace with ceph_readdir_prepopulate and mds_dispatch upstack.
- Unable to handle kernel paging request faults from the ceph-msgr workqueue (ceph_con_workfn).
- Unexpected termination of Ceph client threads coinciding with slab shrinker activity (shrink_slab, prune_dcache_sb).
Detection Strategies
- Correlate kernel ring buffer output (dmesg, journalctl -k) for the signature stack showing ceph_con_workfn calling into jbd2__journal_start.
- Monitor for host reboots or panics on nodes running CephFS clients with ext4 also mounted.
- Track kernel version inventory against the fix commits listed in the kernel.org references to identify unpatched hosts.
Monitoring Recommendations
- Ingest kernel logs into a centralized telemetry pipeline and alert on jbd2__journal_start faults.
- Baseline dentry cache pressure and slab reclaim activity on Ceph-mounted hosts to detect conditions that trigger the crash.
- Track uptime regressions and kworker crashes on storage nodes to surface repeated impact.
How to Mitigate CVE-2026-80528
Immediate Actions Required
- Upgrade affected Linux kernels to a version containing the CephFS NOFS scope fix referenced by the linked stable commits.
- Inventory hosts that mount both CephFS and ext4 and prioritize their patching first.
- Restart hosts after patching to ensure the fixed kernel is active and prior faulted state is cleared.
Patch Information
The fix has been merged across multiple stable branches. Apply the kernel update that includes commits 00c12f57, 47b74574, 4dbb2c02, 5b602344, 79d95b43, b6a09896, c8a21660, and ca5fa238. The patch enters a scoped NOFS allocation context during handle_reply() and clears journal_info before exit.
Workarounds
- Avoid co-mounting CephFS and ext4 on the same host until the kernel is patched.
- Reduce memory pressure on Ceph client nodes to lower the likelihood of direct reclaim during MDS reply processing.
- Increase vm.min_free_kbytes to keep more free pages available and lessen reclaim triggering, understanding this only reduces frequency, not risk.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
