Linux kernel ceph: __ceph_setxattr leaks the preallocated xattr blob on the retry path

Impact

__ceph_setxattr() can stash ci->i_xattrs.prealloc_blob in old_blob when it retries, but never calls ceph_buffer_put() on it, so each retry leaks a kernel buffer. The leak is unbounded in the sense that it is driven by a repeatable user operation, which makes it a slow kernel-memory exhaustion path rather than a corruption bug - the end state is a node under memory pressure or OOM, not an attacker-controlled write. On a GPU fleet the exposure is wherever CephFS is mounted in the kernel for dataset or checkpoint storage, which is typically every worker node and often inside tenant containers, and a node lost to kernel memory exhaustion has to be drained and rebooted rather than restarted cheaply. The upstream record describes only the leak; it does not claim information disclosure or code execution.

Who can reach it

Local: any user or container that can write extended attributes on a kernel-mounted CephFS path, repeatedly enough to drive the retry path. No elevated privileges are implied by the record; nodes without a kernel CephFS mount are not affected (the ceph-fuse and librados userspace clients are a different code path).

What to do

Take the stable kernel fix that adds the missing ceph_buffer_put() for old_blob; the stable commits for the affected branches are linked from the record. Rolling it out means a patched kernel and a reboot of each node that mounts CephFS in the kernel, so plan it as a drain-and-reboot pass rather than a live fix. Until then the leak is reclaimed only by rebooting an affected node; unmounting and remounting CephFS does not return already-leaked buffers.

References

Related entries

• Linux kernel PSI: use-after-free racing a cgroup pressure write against cgroup removalCVE-2026-52991 · Linux kernel sched/psi (cgroup pressure files)High
• Linux kernel ice driver: double free of transmit skb on the TSO/checksum error pathCVE-2026-53009 · Linux kernel ice driver (Intel E810 transmit path tx_buf handling)High
• Linux kernel ccp driver: IV restore overruns the 8-byte RFC3686 IV bufferCVE-2026-53016 · Linux kernel crypto/ccp (AMD Cryptographic Coprocessor, RFC3686 CTR-AES)High
• Linux kernel BPF arena: unvalidated NUMA node_id passed down the page allocation chainCVE-2026-53031 · Linux kernel BPF arena (arena_alloc_pages node_id validation)High
• Linux kernel BPF sockmap: use-after-free on the af_unix peer when a socket closes during iterationCVE-2026-53033 · Linux kernel BPF sockmap (unix_stream_bpf_update_proto, af_unix iterator)High
• Linux kernel BPF: sock_ops same-register context access leaks a kernel pointer and reads out of boundsCVE-2026-53078 · Linux kernel BPF sock_ops context access (SOCK_OPS_GET_SK / SOCK_OPS_GET_FIELD)High