Linux CephFS client: leaked inode reference on aborted writeback panics the node at umount

Impact

When ceph_inc_osd_stopping_blocker() fails during umount, ceph_submit_write() aborts before submission and only redirties the collected folios, so writepages_finish() never runs and the wrbuffer claim taken by ceph_dirty_folio() is leaked along with its ihold(). Every subsequent writeback fails the same blocker, so i_wrbuffer_ref never returns to zero and the inode cannot be evicted, ending in "VFS: Busy inodes after unmount of ceph" and a BUG() at fs/super.c:650. That is a kernel panic on a routine unmount. On a GPU node that mounts CephFS for datasets or checkpoints, an operator draining the node for maintenance can crash it instead of cleanly releasing it, which turns a planned window into an unplanned one.

Who can reach it

Local: unmounting a CephFS mount that still has dirty page cache. No attacker and no authentication is involved - it is a reliability and availability defect triggered by ordinary umount timing.

What to do

Patch the host kernel to a stable release adding ceph_undo_wrbuffer_claim() in the abort path (commits below) and reboot affected nodes. Until then, sync and quiesce writers before unmounting CephFS on a node being drained. The record names no vendor fixed-version string beyond the stable commits.

References

Related entries

• Linux CephFS client: cap reclaim work busy-loops, burning CPU and contending dentry_list_lockCVE-2026-89647 · Linux kernel CephFS client (ceph_cap_reclaim_work / ceph_trim_dentries busy loop)Unscored
• Linux CephFS client: unbounded delegated-inode intervals let a hostile MDS burn client CPU and memoryCVE-2026-89648 · Linux kernel CephFS client (ceph_parse_deleg_inos delegated inode count)Unscored
• Linux CephFS client: unchecked final xattr value length leaks kernel heap via getxattr(2)CVE-2026-89649 · Linux kernel CephFS client (__build_xattrs xattr value length)Unscored
• Linux CephFS client: out-of-bounds read decoding MDS map info v2/v3 export targetsCVE-2026-89650 · Linux kernel CephFS client (ceph_mdsmap_decode num_export_targets)Unscored
• Linux CephFS client: unbounded copy of MDSCapAuth path and fs_name crashes client at mountCVE-2026-89651 · Linux kernel CephFS client (handle_session MDSCapAuth path/fs_name decode)Unscored
• Linux nfsd: use-after-free on an nfs4_client freed during NFSv4.0 revoked-state cleanupCVE-2026-89658 · Linux NFS server (nfsd, nfs40_clean_admin_revoked client refcounting)Unscored