CVE-2026-90042: Linux Kernel Use-After-Free Vulnerability

CVE-2026-90042 Overview

CVE-2026-90042 is a Linux kernel vulnerability in the Ceph distributed filesystem client. The flaw occurs when ceph_fname_to_usr() decrypts filenames from Metadata Server (MDS) reply messages. The messenger client uses kvmalloc() to allocate message buffers, which can place them in the vmalloc() region when physical memory is fragmented. The fscrypt subsystem relies on the scatterlist crypto API, which requires buffers in the linear mapping region. Passing vmalloc() addresses to fscrypt_fname_disk_to_usr() triggers kernel oopses, particularly on non-x86 platforms. The issue affects encrypted Ceph mounts performing directory operations against an MDS.

Critical Impact
Remote MDS responses can cause kernel oops conditions on Ceph clients using fscrypt, leading to denial of service on affected hosts.

Affected Products

Linux kernel Ceph client (fs/ceph) with fscrypt-enabled mounts
Systems using kvmalloc()-backed messenger buffers under memory fragmentation
Non-x86 architectures where vmalloc() addresses are not directly mappable to linear pages

Discovery Timeline

2026-09-16 - CVE-2026-90042 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90042

Vulnerability Analysis

The Ceph client decrypts filenames received from an MDS using the fscrypt subsystem. The callers of ceph_fname_to_usr() pass raw message slices directly as fname->ctext, fname->name, or oname->name. These buffers may originate from kvmalloc() allocations that fall back to vmalloc() under memory pressure. The scatterlist crypto API used by fscrypt cannot process vmalloc()-region addresses because they lack a contiguous physical mapping. When the decryption path dereferences these addresses through the scatterlist interface, the kernel triggers an oops on architectures without unified virtual-to-physical mapping semantics.

Root Cause

The root cause is a mismatch between allocation strategy and cryptographic API requirements. kvmalloc() transparently falls back from kmalloc() to vmalloc() when contiguous physical memory is unavailable. The fscrypt filename decryption path inherits the scatterlist requirement that buffers reside in the linear mapping region. No validation existed between the messenger layer and the decryption path to ensure buffers met this constraint.

Attack Vector

An attacker-controlled or malformed MDS response can trigger the oops when the receiving client allocates the message in the vmalloc() region. The condition depends on memory fragmentation and readdir traffic. Testing referenced in the patch commit observed roughly 1 in 8,000 readdir messages spilling into vmalloc(). Exploitation requires the client to have an encrypted Ceph mount and to process directory entries from the MDS.

No verified exploit code is publicly available. See the upstream fix commit for the corrective logic.

Detection Methods for CVE-2026-90042

Indicators of Compromise

Kernel oops entries in dmesg or journalctl -k referencing ceph_fname_to_usr or fscrypt_fname_disk_to_usr call stacks
Repeated Ceph client crashes correlated with readdir activity on encrypted directories
Bad address faults originating from scatterlist crypto operations on non-x86 hosts

Detection Strategies

Monitor kernel logs for oops messages containing ceph and fscrypt symbols in the backtrace
Correlate client crash timing with MDS reply volume and fragmentation pressure (/proc/buddyinfo)
Track uptime regressions on hosts mounting encrypted CephFS shares

Monitoring Recommendations

Forward kernel logs from all CephFS clients to a centralized logging tier for search on ceph_fname_to_usr
Alert on any process termination or host reboot immediately following CephFS readdir workloads
Baseline memory fragmentation metrics on Ceph clients to identify hosts most likely to hit the fallback path

How to Mitigate CVE-2026-90042

Immediate Actions Required

Apply the upstream kernel patches referenced by commits e939fc6a7bd9, 3b467c68803d, and 110747ff535e from the stable Linux tree
Update Ceph client hosts to a kernel version that includes the ceph_fname_to_usr() bounce-buffer fix
Prioritize non-x86 clients (arm64, ppc64le) where the oops is most reproducible

Patch Information

The fix modifies ceph_fname_to_usr() to tolerate vmalloc()-allocated fname->ctext, fname->name, and oname->name buffers. It uses tname as a bounce buffer when the source is not in the linear region. parse_reply_info_readdir() is updated to pass NULL for tname when the message resides in vmalloc(). Reference commits: 110747ff535e, 3b467c68803d, and e939fc6a7bd9.

Workarounds

Reduce memory fragmentation on Ceph clients by tuning vm.min_free_kbytes and periodic drop_caches where operationally acceptable
Limit exposure by avoiding encrypted CephFS mounts on non-x86 clients until patched kernels are deployed
Restart long-running client hosts to reclaim contiguous memory and reduce kvmalloc() fallback frequency

bash

# Verify running kernel includes the ceph fscrypt fix
uname -r
git -C /usr/src/linux log --oneline | grep -E 'e939fc6a7bd9|3b467c68803d|110747ff535e'

# Check for prior ceph_fname_to_usr oops events
journalctl -k --since "7 days ago" | grep -iE 'ceph_fname_to_usr|fscrypt_fname_disk_to_usr'

# Monitor fragmentation on Ceph clients
cat /proc/buddyinfo