Linux kernel CephFS client: leaked path buffers on error paths exhaust kernel memory

Impact

ceph_mdsc_build_path() takes a name buffer from __getname() and, on several error paths, returned without calling __putname(), leaking the buffer whenever ownership was not handed to the caller via path_info.path. Each leak is one kernel name buffer; repeated under a workload that keeps hitting those error paths, it is unbounded kernel memory growth on any host with a CephFS mount. On GPU nodes that mount CephFS for datasets or checkpoints this is an availability problem on the node itself, and the memory is not reclaimable without a reboot. The record does not establish how easily the error paths are reached from userspace, so treat the rate as unknown.

Who can reach it

Local, through filesystem operations on a mounted CephFS. No special privilege beyond access to the mount is implied by the record; the host must be running the in-kernel CephFS client (the userspace/FUSE client and non-Ceph nodes are unaffected).

What to do

Take the stable kernel fix adding the missing __putname() calls (commits linked from the record). Rollout is a kernel upgrade - drain the node and reboot. Leaked memory on a running node is not recoverable short of a reboot. The record names no fixed release version. Nodes that do not mount CephFS in the kernel need no action.

References

Related entries

• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A correctness defect in the amdkfd (KFD computeCVE-2026-43444 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)Medium
• Linux kernel KVM on AMD: stale CR8 write intercept after AVIC activation desynchronises guest TPRCVE-2026-43483 · Linux kernel KVM/SVM (CR8 write interception vs AVIC activation)Medium
• Linux kernel BPF cgroup storage: bogus pointer read and key copied to userspace at end of listCVE-2026-45838 · Linux kernel BPF (cgroup_storage_get_next_key() end-of-list detection)Medium
• Linux kernel SUNRPC auth_gss: kernel memory leaks on GSS-proxy XDR decode error pathsCVE-2026-45870 · Linux kernel SUNRPC auth_gss (gssx_dec_ctx / gssx_dec_status / gssx_dec_name XDR decode)Medium
• Linux kernel (drivers/pci): A failed mmap of peer-to-peer DMA memory leaks the pgmap reference it took, and the leak isCVE-2026-45880 · Linux kernel (drivers/pci)Medium
• Linux kernel BPF: wrong bpf_xdp_store_bytes argument type lets the helper read uninitialized memoryCVE-2026-45886 · Linux kernel BPF (bpf_xdp_store_bytes helper argument type)Medium