Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-80528— ceph: avoid fs reclaim while using current->journal_info

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： Ceph：在使用 时避免文件系统回收（reclaim） 问题描述： 函数在从 MDS 回复中填充 inode 和 dentry 缓存时，会将一个 指针存储在 中。 在此代码段中的内存分配操作可能会触发直接内存回收（direct reclaim），从而清理其他文件系统的 dentry。如果该操作使 ext4 的某个 inode 变脏（dirty），ext4 就会启动一个 JBD2 事务。然而，JBD2 会将 中存储的 Ceph 请求误认为是日志句柄（journal han

CVSS 9.8 · Critical

Possible ATT&CK Techniques 1 AI

T1027 · Obfuscated Files or Information

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 315f24088048a51eed341c53be66ea477a3c7d16< ca5fa2380dd90a0adb01580fa6225025351a90f6 affected
315f24088048a51eed341c53be66ea477a3c7d16< 00c12f57a87f537fa8779258fb3a03003a99963e affected
315f24088048a51eed341c53be66ea477a3c7d16< 4dbb2c02558e71f93510a6461d7e798b67426b49 affected
315f24088048a51eed341c53be66ea477a3c7d16< c8a21660c3b90864c391164eea5622e7b5b2897c affected
315f24088048a51eed341c53be66ea477a3c7d16< 47b745747b3aa39064724a642884f9df924ddf20 affected
315f24088048a51eed341c53be66ea477a3c7d16< 79d95b43ca090426399651ed580dd9bf2db36ab8 affected
315f24088048a51eed341c53be66ea477a3c7d16< b6a0989613072499633e761a1536428a466de7d3 affected
315f24088048a51eed341c53be66ea477a3c7d16< 5b602344a49e039e792ce5a8923bcc61412ee134 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80528

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ceph: avoid fs reclaim while using current->journal_info
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ceph: avoid fs reclaim while using current->journal_info handle_reply() stores a `ceph_mds_request` pointer in `current->journal_info` while filling the inode and dentry cache from an MDS reply. An allocation in this section can enter direct reclaim and prune dentries from another filesystem. If this dirties an ext4 inode, ext4 starts a JBD2 transaction. JBD2 interprets the Ceph request in `current->journal_info` as a journal handle and dereferences the request's `r_tid` as `h_transaction`, causing a kernel crash, e.g.: Unable to handle kernel paging request at virtual address 00000000077b4818 [...] Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 6 UID: 0 PID: 2699135 Comm: kworker/6:3 Tainted: G W 6.18.38-i3 #1113 NONE [...] Workqueue: ceph-msgr ceph_con_workfn pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : jbd2__journal_start+0x2c/0x208 lr : __ext4_journal_start_sb+0x100/0x178 [...] Call trace: jbd2__journal_start+0x2c/0x208 (P) __ext4_journal_start_sb+0x100/0x178 ext4_dirty_inode+0x3c/0x90 __mark_inode_dirty+0x58/0x400 iput.part.0+0x2b0/0x370 iput+0x18/0x30 dentry_unlink_inode+0xc0/0x158 __dentry_kill+0x80/0x250 shrink_dentry_list+0x90/0x130 prune_dcache_sb+0x60/0x98 super_cache_scan+0xe8/0x190 do_shrink_slab+0x174/0x388 shrink_slab+0xd8/0x4c0 shrink_node+0x31c/0x908 do_try_to_free_pages+0xd0/0x508 try_to_free_pages+0x11c/0x238 __alloc_frozen_pages_noprof+0x4d0/0xdd0 __folio_alloc_noprof+0x18/0x70 __filemap_get_folio+0x248/0x440 ceph_readdir_prepopulate+0x570/0x9e8 mds_dispatch+0x1424/0x1ba0 ceph_con_process_message+0x74/0xa0 ceph_con_v1_try_read+0x3a0/0x1510 ceph_con_workfn+0x260/0x460 Enter a scoped NOFS allocation context and leave it after clearing `journal_info`. This prevents filesystem reclaim from recursing into another filesystem while the field contains Ceph-private data.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 315f24088048a51eed341c53be66ea477a3c7d16 ~ ca5fa2380dd90a0adb01580fa6225025351a90f6 -
Linux Linux 4.6 -

II. Public POCs for CVE-2026-80528

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80528

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-80528 (8)

Same Patch Batch · Linux · 2026-08-26 · 92 CVEs total

CVE-2026-80561 9.8 CRITICAL libceph: fix multiple unsafe decodes in decode_locker()
CVE-2026-80557 9.8 CRITICAL libceph: fix OOB read in decode_watchers() via missing bounds check
CVE-2026-74746 9.8 CRITICAL netfilter: flowtable: publish GC-visible tuple last
CVE-2026-80558 9.8 CRITICAL libceph: Avoid using invalid osd indices from primary_temp
CVE-2026-74744 9.8 CRITICAL ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
CVE-2026-74743 9.8 CRITICAL macvlan: inherit needed_headroom and needed_tailroom from lowerdev
CVE-2026-74752 9.8 CRITICAL sctp: validate cookie AUTH state before use
CVE-2026-80586 9.8 CRITICAL mptcp: options: reset DSS fields in case of unexpected size
CVE-2026-80587 9.8 CRITICAL mptcp: avoid combining some incoming suboptions
CVE-2026-80519 9.8 CRITICAL ovpn: finish crypto callback cleanup before peer release
CVE-2026-74737 9.8 CRITICAL net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
CVE-2026-80589 9.8 CRITICAL block: stop the timeout timer when releasing a never added disk
CVE-2026-74751 9.4 CRITICAL riscv: lib: Fix ZBB strnlen reading past count boundary
CVE-2026-80585 9.4 CRITICAL mptcp: fastopen: only mark MPTFO subflows with SYN data
CVE-2026-80551 9.3 CRITICAL s390/vfio_ccw: Ensure first IDAW remains constant
CVE-2026-80554 9.3 CRITICAL s390/vfio_ccw: Limit the number of channel program segments
CVE-2026-80576 8.8 HIGH drm/amdgpu: reject oversized IBs with per-ring packet limits
CVE-2026-80548 8.8 HIGH s390/vfio_ccw: Selectively expand io_mutex
CVE-2026-80553 8.8 HIGH s390/vfio_ccw: Cancel existing workqueues
CVE-2026-80552 8.8 HIGH s390/vfio_ccw: Ensure index for read/write regions are within range

Showing top 20 of 92 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-80528

No comments yet

Leave a comment