Linux kernel CephFS client: stale xattr blob size hits a BUG_ON and panics the node

Impact

A stale xattr blob size in the kernel CephFS client trips a BUG_ON in __ceph_build_xattrs_blob() while the ceph-msgr workqueue is processing an MDS cap grant, taking the whole node down rather than just the mount. The crash happens in a kernel worker handling messages from the MDS, so it is not confined to the process that touched the file - any GPU node that mounts CephFS for datasets or checkpoints can panic mid-job. On a fleet where CephFS is the shared training data path this is a fleet-wide availability concern, since every node runs the same client code against the same MDS. The record rates it local, availability-only (CVSS 5.5); there is no confidentiality or integrity claim.

Who can reach it

Local user on a node with a CephFS mount performing normal file operations that exercise xattrs; no special privilege beyond access to the mount is described. The trigger in the report is the generic/642 filesystem test, not a crafted remote input.

What to do

Take the stable kernel containing the fix (commits linked in the record) from your distro and reboot each node; the CephFS client is in-kernel, so there is no daemon-restart path. Drain GPU workloads before rebooting. No fixed mainline version number is stated in the record beyond the 7.1 development line, so confirm the backport against your vendor kernel.

References

Related entries

• Linux amd-pstate - memory leak in amd_pstate_epp_cpu_init(): On failure to set the energy-performance preferenceCVE-2026-53121 · Linux amd-pstate - memory leak in amd_pstate_epp_cpu_init()Medium
• Linux iommu/amd - devid bounds check in __rlookup_amd_iommu(): The AMD IOMMU driver looked up device IDs withoutCVE-2026-53283 · Linux iommu/amd - devid bounds check in __rlookup_amd_iommu()Medium
• Linuxfabrik monitoring plugins: sudo-authorized checks read arbitrary root-readable files via --testCVE-2026-73974 · Linuxfabrik Monitoring Plugins / linuxfabrik-lib (lib.lftest.test --test path handling)Medium
• community.general ipa_getkeytab: IPA/LDAP bind password written to logs and exposed in the process listCVE-2026-80158 · Ansible community.general ipa_getkeytab module (bind_pw not declared no_log)Medium
• Harbor (audit log redaction, LDAP password and OIDC client secret): CREDENTIAL DISCLOSURE VIA THE AUDIT TRAIL: HarborNCVD-2026-058-harbor-audit-log-redaction-ldap · Harbor (audit log redaction, LDAP password and OIDC client secret)Medium
• Kubeflow (central dashboard, reflected cross-site scripting): Reflected XSS in the Kubeflow dashboard runs attackerCVE-2023-6571 · Kubeflow (central dashboard, reflected cross-site scripting)Medium