Linux kernel CephFS client: invalid kfree() when listing .snap directories oopses the node

Impact

In parse_longname() the string guarded by __free(kfree) is advanced past a leading underscore, so kfree() is later handed a pointer that was never allocated. Simply listing a CephFS snapshot directory (ls /mnt/ceph/.snap) oopses the kernel and hangs the listing process. Operators who mount CephFS on GPU nodes and keep snapshots of training datasets can hit this during ordinary backup or restore inspection, and the resulting oops means a node reboot rather than a clean unmount. The record rates it local availability-only (CVSS 5.5).

Who can reach it

Any local user with read access to a CephFS mount that has snapshots; no authentication beyond mount access, and no crafted input is needed - a directory listing is enough.

What to do

Update to a stable kernel carrying the linked fix commits and reboot each affected node; drain GPU jobs first. As an interim measure, keep users out of .snap directories on affected kernels. The record does not name a released fixed version beyond the 6.19 line, so verify the backport with your distro.

References

Related entries

• Linux perf/x86 - event pointer setup ordering in x86_pmu_enable(): A NULL pointer dereference in the x86 PMU enableCVE-2026-23435 · Linux perf/x86 - event pointer setup ordering in x86_pmu_enable()Medium
• GitLab EE: project Maintainer can open a terminal on a protected environment they are not authorized forCVE-2026-3035 · GitLab EE (protected environment terminal authorization)Medium
• Linux EDAC/mc - error path ordering in edac_mc_alloc(): When a private-data allocation fails in edac_mc_alloc()CVE-2026-31689 · Linux EDAC/mc - error path ordering in edac_mc_alloc()Medium
• Linux iommu/vt-d (dev-IOTLB flush in scalable mode): The scalable-mode half of the device-IOTLB invalidation problem —CVE-2026-43130 · Linux iommu/vt-d (dev-IOTLB flush in scalable mode)Medium
• Linux iommu/vt-d (dev-IOTLB flush for passed-through PCIe devices): The Intel IOMMU driver skips device-IOTLBCVE-2026-43161 · Linux iommu/vt-d (dev-IOTLB flush for passed-through PCIe devices)Medium
• Linux kernel CephFS client: stale xattr blob size hits a BUG_ON and panics the nodeCVE-2026-52961 · Linux kernel CephFS client (__ceph_build_xattrs_blob)Medium