CVE-2026-80527 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix hanging __ceph_get_caps() with stale mds_wanted
A reader can hang forever in __ceph_get_caps() when the client no longer holds `FILE_RD`, but local cap state still says that the capability is already wanted (via `mds_wanted`).
One way to trigger this is through MDS cap revocation. If another client performs a conflicting operation, the MDS can revoke `FILE_RD` from the reader; the next read then has to reacquire `FILE_RD`. If the cap update that should request `FILE_RD` never reaches the MDS after `cap->mds_wanted` was raised, the reader is left holding only non-file caps while local `mds_wanted` still includes the file read caps.
In that state, try_get_cap_refs() sees `need <= mds_wanted` and returns 0, so __ceph_get_caps() just waits on `i_cap_wq`. If the cap update that was supposed to request `FILE_RD never reaches the MDS after `cap->mds_wanted was` raised, no further request is sent and the waiter can sleep indefinitely until unrelated cap traffic happens to wake it up.
The ordering issue is that `cap->mds_wanted` is updated in __prep_cap() before the `CEPH_MSG_CLIENT_CAPS message` is actually queued for send. That makes one field serve two different meanings at once: what this client wants, and what the client believes the MDS already knows it wants.
A proper fix would be to split those states and track whether a cap update is actually in flight or has been observed by the MDS. However, simply moving the `cap->mds_wanted assignment` later would not be sufficient: queueing the message in the messenger does not guarantee that the MDS processed that specific wanted set, and reconnect or message loss can still invalidate that assumption. Fixing that properly would require a larger rework of the cap state machine.
To allow simpler backports to stable kernels, this patch implements a simpler workaround:
- stop waiting forever in __ceph_get_caps(); after a bounded wait, fall back to the renew path
- make ceph_renew_caps() issue a synchronous `OPEN` request whenever the inode still does not actually hold the wanted caps, instead of only calling ceph_check_caps()
The extra issued-vs-wanted check in ceph_renew_caps() is necessary because the previous test only checked whether the inode still had any real caps at all. That is not enough after revocation: the client can still hold something like `pLs` and yet be missing `FILE_RD` completely. In that case, falling back to ceph_check_caps() is not sufficient, because it still trusts `cap->mds_wanted` and may resend nothing. By requiring `(issued & wanted) == wanted` before taking the asynchronous path, the code only uses ceph_check_caps() when the `wanted caps` are already actually issued. Otherwise, it sends the synchronous `OPEN` renew.
This preserves the existing asynchronous fast path when the wanted caps are already issued, avoids changing cap-state semantics, and fixes the hang by guaranteeing that a stalled waiter eventually retries through a path that does not rely on the stale `mds_wanted` state.
[ idryomov: move CEPH_GET_CAPS_WAIT_TIMEOUT from libceph.h to
mds_client.h, formatting ]
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The Linux kernel Ceph client implementation contains a logic flaw within the capability management subsystem that can lead to indefinite process hangs during file read operations. This vulnerability specifically affects the __ceph_get_caps() function when there is a desynchronization between the local state of the client and the actual capabilities granted by the Metadata Server (MDS). The core issue arises from an ordering error in how capability requests are tracked, where the internal flag indicating desired capabilities is updated before the corresponding network message is successfully queued for transmission. This creates a race condition where the client believes it has requested specific access rights that have not yet been acknowledged or processed by the remote server, leading to a state of inconsistency that can stall execution indefinitely.
The operational impact manifests when a reader process attempts to acquire read permissions on an inode but no longer holds the FILE_RD capability due to revocation by another conflicting client operation. In such scenarios, the MDS may revoke existing read access, requiring the local client to reacquire it. However, if the cap update message intended to request FILE_RD fails to reach the MDS or is lost in transit after the local mds_wanted flag was raised, the client enters a problematic state. The try_get_cap_refs() function observes that the needed capabilities are already marked as wanted locally and returns zero, causing __ceph_get_caps() to enter an infinite wait on the i_cap_wq queue. Since no further request is sent due to this stale local belief, the waiting thread remains blocked until unrelated cap traffic inadvertently wakes it up, resulting in a denial of service for applications relying on that file handle.
From a technical architecture perspective, the root cause lies in the dual use of the cap->mds_wanted field within the Ceph client state machine. This variable currently serves two conflicting purposes: tracking what the local client wants and implicitly assuming what the MDS already knows about those desires. The vulnerability exploits this ambiguity by updating the wanted flag before ensuring the message is queued, thereby decoupling intent from transmission status. A robust fix would require a significant rework of the cap state machine to explicitly track whether updates are in flight or have been observed by the MDS. However, such a comprehensive refactor introduces complexity that makes it unsuitable for stable kernel backports due to potential side effects on existing functionality and performance characteristics.
To address this issue without disrupting the broader codebase, the implemented mitigation adopts a pragmatic workaround focused on bounded waiting and explicit renewal mechanisms. The solution modifies __ceph_get_caps() to prevent infinite blocking by introducing a timeout threshold after which it falls back to a renew path rather than continuing to wait for potentially unresponsive network events. Concurrently, ceph_renew_caps() is enhanced to issue synchronous OPEN requests when the inode does not actually hold the wanted caps. This ensures that if the asynchronous check fails because local state is stale, a direct request is sent to refresh permissions immediately.
The logic within ceph_renew_caps() now performs an explicit verification comparing issued capabilities against wanted ones before proceeding with asynchronous checks. By requiring that (issued & wanted) == wanted, the code guarantees that it only relies on cached state when it is accurate. If this condition fails, indicating a mismatch between local expectations and actual grants, the system triggers a synchronous OPEN renew operation. This approach preserves the performance benefits of the existing asynchronous fast path while effectively eliminating the hang scenario by ensuring that stalled waiters eventually retry through a reliable communication channel independent of stale mds_wanted flags.
This vulnerability aligns with CWE-835, which describes logic errors involving loops and infinite waiting conditions, as well as CWE-662 regarding improper synchronization where concurrent operations lead to unexpected behavior due to race conditions in state management. In the context of MITRE ATT&CK, this flaw relates to T1499 Endpoint Denial of Service variants that exploit software vulnerabilities to disrupt service availability. The fix ensures system resilience by preventing local resource exhaustion and process hangs caused by network latency or message loss during critical file access operations.