Linux kernel ceph client: uninitialized ceph_path_info leads to freeing an object from the wrong slab cache

Impact

ceph_mdsc_build_path() only initializes its ceph_path_info argument on success, and several callers added by the r_parent race fix passed an uninitialized struct, then called ceph_mdsc_free_path_info() on the failure path anyway. The published crash shows the freeing of a ceph_inode_info object through names_cache, a wrong-slab-cache free that ends in kernel BUG at mm/slub.c and a dead node; the reporter notes it may be possible to use this for privilege elevation, which is speculation in the record rather than a demonstrated exploit. This lands on GPU fleets that mount CephFS in the kernel for datasets and checkpoints: the path runs on ordinary file opens, so an unlucky or deliberately hostile workload can take out a node whose GPUs are mid-training, and the panic is on the storage client every node shares.

Who can reach it

Local, any user or container process doing filesystem operations on a kernel-mounted CephFS - ceph_open() is in the published trace. No privileges beyond access to the mount; triggering it requires the build-path call to fail, which depends on MDS state and timing.

What to do

Update to a stable kernel with the added zero initializers (four branches carry backports) and reboot the node; the ceph module cannot be reloaded while the filesystem is mounted, so drain first. Fleets that reach Ceph through the FUSE client or an S3/RGW gateway rather than the kernel client are not affected by this id.

References

Related entries

• VMware Avi Load Balancer: local user can escalate to root on the applianceCVE-2026-47868 · VMware Avi Load Balancer (Controller and Service Engine appliance)High
• Linuxfabrik monitoring plugins: pipe injection in shell_exec escalates a check account to rootCVE-2026-55426 · Linuxfabrik Monitoring Plugins / linuxfabrik-lib (lib.shell.shell_exec)High
• Apache Storm worker-launcher: TOCTOU on the command file gives a tenant root-equivalent container launchCVE-2026-82430 · Apache Storm worker-launcher (setuid-root Docker/OCI worker launch)High
• SonicWall SMA1000: authenticated admin can inject OS commands through the management consoleCVE-2026-83549 · SonicWall SMA1000 appliance (Appliance Management Console, OS command injection)High
• Linux kernel nfsd: module init error path leaves debugfs files pointing into freed module textCVE-2026-89668 · Linux kernel nfsd (debugfs init ordering in init_nfsd)High
• CyberPower PowerPanel managed devices - shared device certificates: Every managed device uses an identical certificateCVE-2024-31410 · CyberPower PowerPanel managed devices - shared device certificatesHigh