CVE-2026-89647: Linux Kernel Ceph DOS Vulnerability

CVE-2026-89647 Overview

CVE-2026-89647 is a denial-of-service vulnerability in the Linux kernel's Ceph client filesystem. The flaw lives in ceph_cap_reclaim_work(), which repeatedly re-queues itself while ceph_trim_dentries() returns -EAGAIN. When no capabilities need reclaiming and every scanned lease remains valid, each pass drains the full nr_to_scan budget and immediately requeues, creating a CPU-consuming busy loop. The __dir_lease_check() function compounds the problem by returning TOUCH for every valid lease when expire_dir_lease is false, which churns the dentry list and refreshes timestamps so leases never age out. The kernel maintainer observed 500 ceph_trim_dentries() calls per second on production web servers before the fix.

Critical Impact
Remote-exposed Ceph clients experience sustained CPU exhaustion and heavy contention on &mdsc->dentry_list_lock, degrading availability of services backed by CephFS.

Affected Products

Linux kernel Ceph client (CephFS) — versions prior to the fix commits listed under Patch Information
Distributions shipping vulnerable stable kernel trees mounting CephFS
Workloads using the kernel Ceph client with active dentry-lease traffic (for example, web-serving fleets on CephFS)

Discovery Timeline

2026-09-11 - CVE-2026-89647 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89647

Vulnerability Analysis

The defect is an algorithmic-complexity and resource-exhaustion bug in the CephFS dentry-lease reclaim path [Resource Exhaustion]. ceph_cap_reclaim_work() schedules itself as long as ceph_trim_dentries() reports -EAGAIN, which the function returns whenever the lease walk consumes its nr_to_scan budget. With no cap pressure (count==0) and valid leases, every pass burns the budget without freeing anything and immediately requeues.

The secondary defect is in __dir_lease_check(). When expire_dir_lease is false, the check returned TOUCH for each valid lease. TOUCH moves the dentry to the tail of the list and resets di->time via __dentry_dir_lease_touch(). This rewrites the list, refreshes timestamps so leases never expire naturally, and guarantees the budget hits zero. Lock statistics captured over five minutes showed 128,218 contentions on &mdsc->dentry_list_lock and total wait time above 15.9 seconds.

Root Cause

The root cause is a control-flow error in the reclaim worker combined with an incorrect return value from the dir-lease check. Returning TOUCH for leases the caller has no intention of reclaiming perpetually resets state that the aging logic depends on. Returning -EAGAIN after a full scan that freed nothing signals the workqueue to retry immediately, even though repeating the same walk cannot make progress.

Attack Vector

The attack vector is network-adjacent through normal CephFS workload patterns rather than a crafted exploit payload. Any environment that keeps a large working set of valid dentry leases can trigger the busy loop. The impact is CPU exhaustion and lock contention on &mdsc->dentry_list_lock, degrading throughput for every filesystem consumer on the affected host.

No verified proof-of-concept code is published for this issue. Refer to the upstream commits under Patch Information for the exact code paths.

Detection Methods for CVE-2026-89647

Indicators of Compromise

Sustained high call rate of ceph_trim_dentries() — the maintainer observed roughly 500 calls per second before the fix.
Elevated contention counts on &mdsc->dentry_list_lock visible in /proc/lock_stat.
Frequent scheduling of ceph_cap_reclaim_work() on hosts with no measurable Ceph cap pressure.

Detection Strategies

Enable CONFIG_LOCK_STAT and inspect /proc/lock_stat for &mdsc->dentry_list_lock contention counts that grow linearly with uptime.
Sample kernel stacks with perf top or bpftrace and look for __dentry_leases_walk, __ceph_dentry_dir_lease_touch, and ceph_trim_dentries dominating on-CPU time.
Correlate elevated system CPU on CephFS clients with workqueue activity for ceph_cap_reclaim_work.

Monitoring Recommendations

Add alerting on system CPU utilization for hosts mounting CephFS, with a threshold that fires on sustained non-workload kernel CPU.
Track kernel version inventory to identify hosts still running pre-patch stable trees.
Forward /proc/lock_stat snapshots into a centralized log or telemetry pipeline for trend analysis across the fleet.

How to Mitigate CVE-2026-89647

Immediate Actions Required

Update to a Linux stable kernel that includes the fix commits listed below.
Prioritize patching hosts that mount CephFS and serve high dentry-cache workloads such as web servers.
Reboot after upgrade to activate the fixed kernel across the fleet.

Patch Information

The fix applies three changes: __dir_lease_check() returns KEEP instead of TOUCH when expire_dir_lease is false, the dentry-lease walk returns -EAGAIN only when it actually freed something, and the worker exits with success when nothing was freed and count==0. Upstream commits: Kernel Git Commit 37d6edb, Kernel Git Commit 3d122b2, Kernel Git Commit 5a541eb, and Kernel Git Commit e7d7aa7.

Workarounds

No supported code-level workaround exists; the fix requires the patched kernel.
Where patching is delayed, reduce CephFS dentry cache pressure by tuning workload access patterns or shifting traffic to unaffected hosts.
Monitor /proc/lock_stat and restart affected services if lock contention becomes severe before the maintenance window.

bash

# Verify running kernel and Ceph client module version
uname -r
modinfo ceph | grep -E '^(version|srcversion|filename):'

# Sample lock contention to confirm the busy loop is present
cat /proc/lock_stat | grep -A2 dentry_list_lock