Linux kernel CephFS client: readers hang indefinitely after cap revocation leaves stale mds_wanted

Impact

cap->mds_wanted is raised in __prep_cap() before the client caps message is actually queued, so it conflates what the client wants with what the MDS is believed to know. If an MDS revokes FILE_RD after a conflicting operation from another client and the cap update never reaches the MDS, try_get_cap_refs() sees need <= mds_wanted, returns 0, and __ceph_get_caps() sleeps on i_cap_wq with no further request sent. The reader can stay blocked until unrelated cap traffic happens to wake it. On a fleet that mounts CephFS for datasets or checkpoints, that is an uninterruptible-read hang in a training or serving process, and the usual recovery is killing the job or rebooting the node rather than clearing a queue.

Who can reach it

Local processes reading files on a kernel CephFS mount; the trigger is ordinary concurrent access from another client causing the MDS to revoke FILE_RD, so no authentication step beyond having the filesystem mounted is involved. Not reachable on nodes that do not mount CephFS.

What to do

Apply the stable fix, which bounds the wait in __ceph_get_caps() and makes ceph_renew_caps() issue a synchronous OPEN whenever the wanted caps are not actually issued; the commit describes this as a backportable workaround rather than the full cap-state rework. Five stable commits are listed and the record names no fixed release. Rollout is a patched kernel and a per-node reboot, so drain and reboot nodes that mount CephFS.

References

Related entries

• Linux kernel CephFS client: reclaim during MDS reply handling crashes the kernel via ext4 journal_infoCVE-2026-80528 · Linux kernel CephFS client (handle_reply / current->journal_info vs direct reclaim)Unscored
• Linux kernel libceph: out-of-bounds read in decode_watchers() from a zero-length struct_lenCVE-2026-80557 · Linux kernel libceph (decode_watchers(), CEPH_OSD_OP_LIST_WATCHERS reply parsing)Unscored
• Linux kernel libceph: unvalidated primary_temp OSD index causes out-of-bounds array readsCVE-2026-80558 · Linux kernel libceph (get_temp_osds(), unvalidated primary_temp OSD index)Unscored
• Linux kernel libceph: unchecked decodes in decode_locker() let a malicious OSD read out of boundsCVE-2026-80561 · Linux kernel libceph (cls_lock_client decode_locker)Unscored
• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical
• Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the hostCVE-2026-48751 · Incus (instance snapshots ignore restricted.containers.lowlevel)Critical