ceph: fix hanging __ceph_get_caps() with stale mds_wanted

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-80527
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-26 15:17:06 UTC
Updated2026-08-27 06:17:32 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: ceph: fix hanging __ceph_get_caps() with stale mds_wanted A reader can hang forever in __ceph_get_caps() when the client no longer holds `FILE_RD`, but local cap state still says that the capability is already wanted (via `mds_wanted`). One way to trigger this is through MDS cap revocation. If another client performs a conflicting operation, the MDS can revoke `FILE_RD` from the reader; the next read then has to reacquire `FILE_RD`. If the cap update that should request `FILE_RD` never reaches the MDS after `cap->mds_wanted` was raised, the reader is left holding only non-file caps while local `mds_wanted` still includes the file read caps. In that state, try_get_cap_refs() sees `need <= mds_wanted` and returns 0, so __ceph_get_caps() just waits on `i_cap_wq`. If the cap update that was supposed to request `FILE_RD never reaches the MDS after `cap->mds_wanted was` raised, no further request is sent and the waiter can sleep indefinitely until unrelated cap traffic happens to wake it up. The ordering issue is that `cap->mds_wanted` is updated in __prep_cap() before the `CEPH_MSG_CLIENT_CAPS message` is actually queued for send. That makes one field serve two different meanings at once: what this client wants, and what the client believes the MDS already knows it wants. A proper fix would be to split those states and track whether a cap update is actually in flight or has been observed by the MDS. However, simply moving the `cap->mds_wanted assignment` later would not be sufficient: queueing the message in the messenger does not guarantee that the MDS processed that specific wanted set, and reconnect or message loss can still invalidate that assumption. Fixing that properly would require a larger rework of the cap state machine. To allow simpler backports to stable kernels, this patch implements a simpler workaround: - stop waiting forever in __ceph_get_caps(); after a bounded wait, fall back to the renew path - make ceph_renew_caps() issue a synchronous `OPEN` request whenever the inode still does not actually hold the wanted caps, instead of only calling ceph_check_caps() The extra issued-vs-wanted check in ceph_renew_caps() is necessary because the previous test only checked whether the inode still had any real caps at all. That is not enough after revocation: the client can still hold something like `pLs` and yet be missing `FILE_RD` completely. In that case, falling back to ceph_check_caps() is not sufficient, because it still trusts `cap->mds_wanted` and may resend nothing. By requiring `(issued & wanted) == wanted` before taking the asynchronous path, the code only uses ceph_check_caps() when the `wanted caps` are already actually issued. Otherwise, it sends the synchronous `OPEN` renew. This preserves the existing asynchronous fast path when the wanted caps are already issued, avoids changing cap-state semantics, and fixes the hang by guaranteeing that a stalled waiter eventually retries through a path that does not rely on the stale `mds_wanted` state. [ idryomov: move CEPH_GET_CAPS_WAIT_TIMEOUT from libceph.h to mds_client.h, formatting ]

Risk And Classification

Primary CVSS: v3.1 7.5 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
3.1CNADECLARED7.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v3.1 Breakdown

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c b5661524c5a45085a866864ca9b8ae2513dfd67a git Not specified
CNA Linux Linux affected 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c 5e84bc6f67e19fdd192d8b215de728acbfc12572 git Not specified
CNA Linux Linux affected 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c 5fedf279a1ea369d39c8b06dd4547cdc576065d0 git Not specified
CNA Linux Linux affected 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c e05c315b4da0c16ea800ee4b2cb6c617f586d1b5 git Not specified
CNA Linux Linux affected 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c fcce1b3be6d286aa80831e730289f4c062053ae6 git Not specified
CNA Linux Linux affected 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c a3bc6b3e9ef3f5f5cb85a902a30a090c7931127c git Not specified
CNA Linux Linux affected 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c 9e55fe24c548ad3163903eb58bb002d28d32a630 git Not specified
CNA Linux Linux affected 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c 50958bb928bad3bdba9e5d1b7ff4bbadcf6951e6 git Not specified
CNA Linux Linux affected 5.8 Not specified
CNA Linux Linux unaffected 5.8 semver Not specified
CNA Linux Linux unaffected 5.10.266 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.217 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.184 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.153 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.105 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.46 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.10 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/9e55fe24c548ad3163903eb58bb002d28d32a630 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a3bc6b3e9ef3f5f5cb85a902a30a090c7931127c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/5e84bc6f67e19fdd192d8b215de728acbfc12572 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/fcce1b3be6d286aa80831e730289f4c062053ae6 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/50958bb928bad3bdba9e5d1b7ff4bbadcf6951e6 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/5fedf279a1ea369d39c8b06dd4547cdc576065d0 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b5661524c5a45085a866864ca9b8ae2513dfd67a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e05c315b4da0c16ea800ee4b2cb6c617f586d1b5 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report