Linux CephFS client: cap reclaim work busy-loops, burning CPU and contending dentry_list_lock

Impact

ceph_cap_reclaim_work() re-queues itself for as long as ceph_trim_dentries() returns -EAGAIN, which it does whenever the lease walk exhausts its scan budget - including when there is no cap pressure and nothing to reclaim. The dir-lease walk made it worse by returning TOUCH for every valid lease, rewriting the list and refreshing timestamps so leases never aged out. The reporter measured 500 ceph_trim_dentries() calls per second on production servers, with heavy contention on mdsc->dentry_list_lock visible in lock_stat. On a GPU node with a CephFS mount this is steady background CPU burn and lock contention on the data path that feeds training jobs - a performance regression, not a security boundary crossing.

Who can reach it

Local and non-adversarial: any node with a CephFS mount holding many valid dentry leases and no cap pressure. No attacker involvement.

What to do

Patch the host kernel to a stable release carrying the KEEP-instead-of-TOUCH change and the -EAGAIN/bail-out conditions (commits below) and reboot the affected nodes. There is no configuration mitigation in the record. No vendor fixed-version string is given beyond the stable commits.

References

Related entries

• Linux CephFS client: unbounded delegated-inode intervals let a hostile MDS burn client CPU and memoryCVE-2026-89648 · Linux kernel CephFS client (ceph_parse_deleg_inos delegated inode count)Unscored
• Linux CephFS client: unchecked final xattr value length leaks kernel heap via getxattr(2)CVE-2026-89649 · Linux kernel CephFS client (__build_xattrs xattr value length)Unscored
• Linux CephFS client: out-of-bounds read decoding MDS map info v2/v3 export targetsCVE-2026-89650 · Linux kernel CephFS client (ceph_mdsmap_decode num_export_targets)Unscored
• Linux CephFS client: unbounded copy of MDSCapAuth path and fs_name crashes client at mountCVE-2026-89651 · Linux kernel CephFS client (handle_session MDSCapAuth path/fs_name decode)Unscored
• Linux nfsd: use-after-free on an nfs4_client freed during NFSv4.0 revoked-state cleanupCVE-2026-89658 · Linux NFS server (nfsd, nfs40_clean_admin_revoked client refcounting)Unscored
• Linux nfsd: use-after-free when a client is torn down while an expired delegation is being revokedCVE-2026-89659 · Linux NFS server (nfsd, revoke_delegation / nfs4_laundromat client lifetime)Unscored