GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-46052 (GCVE-0-2026-46052)

Vulnerability from cvelistv5 – Published: 2026-05-27 12:57 – Updated: 2026-08-05 12:29
VLAI
Title
ceph: only d_add() negative dentries when they are unhashed
Summary
In the Linux kernel, the following vulnerability has been resolved: ceph: only d_add() negative dentries when they are unhashed Ceph can call d_add(dentry, NULL) on a negative dentry that is already present in the primary dcache hash. In the current VFS that is not safe. d_add() goes through __d_add() to __d_rehash(), which unconditionally reinserts dentry->d_hash into the hlist_bl bucket. If the dentry is already hashed, reinserting the same node can corrupt the bucket, including creating a self-loop. Once that happens, __d_lookup() can spin forever in the hlist_bl walk, typically looping only on the d_name.hash mismatch check and eventually triggering RCU stall reports like this one: rcu: INFO: rcu_sched self-detected stall on CPU rcu: 87-....: (2100 ticks this GP) idle=3a4c/1/0x4000000000000000 softirq=25003319/25003319 fqs=829 rcu: (t=2101 jiffies g=79058445 q=698988 ncpus=192) CPU: 87 UID: 2952868916 PID: 3933303 Comm: php-cgi8.3 Not tainted 6.18.17-i1-amd #950 NONE Hardware name: Dell Inc. PowerEdge R7615/0G9DHV, BIOS 1.6.6 09/22/2023 RIP: 0010:__d_lookup+0x46/0xb0 Code: c1 e8 07 48 8d 04 c2 48 8b 00 49 89 fc 49 89 f5 48 89 c3 48 83 e3 fe 48 83 f8 01 77 0f eb 2d 0f 1f 44 00 00 48 8b 1b 48 85 db <74> 20 39 6b 18 75 f3 48 8d 7b 78 e8 ba 85 d0 00 4c 39 63 10 74 1f RSP: 0018:ff745a70c8253898 EFLAGS: 00000282 RAX: ff26e470054cb208 RBX: ff26e470054cb208 RCX: 000000006e958966 RDX: ff26e48267340000 RSI: ff745a70c82539b0 RDI: ff26e458f74655c0 RBP: 000000006e958966 R08: 0000000000000180 R09: 9cd08d909b919a89 R10: ff26e458f74655c0 R11: 0000000000000000 R12: ff26e458f74655c0 R13: ff745a70c82539b0 R14: d0d0d0d0d0d0d0d0 R15: 2f2f2f2f2f2f2f2f FS: 00007f5770896980(0000) GS:ff26e482c5d88000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5764de50c0 CR3: 000000a72abb5001 CR4: 0000000000771ef0 PKRU: 55555554 Call Trace: <TASK> lookup_fast+0x9f/0x100 walk_component+0x1f/0x150 link_path_walk+0x20e/0x3d0 path_lookupat+0x68/0x180 filename_lookup+0xdc/0x1e0 vfs_statx+0x6c/0x140 vfs_fstatat+0x67/0xa0 __do_sys_newfstatat+0x24/0x60 do_syscall_64+0x6a/0x230 entry_SYSCALL_64_after_hwframe+0x76/0x7e This is reachable with reused cached negative dentries. A Ceph lookup or atomic_open can be handed a negative dentry that is already hashed, and fs/ceph/dir.c then hits one of two paths that incorrectly assume "negative" also means "unhashed": - ceph_finish_lookup(): MDS reply is -ENOENT with no trace -> d_add(dentry, NULL) - ceph_lookup(): local ENOENT fast path for a complete directory with shared caps -> d_add(dentry, NULL) Both paths can therefore re-add an already-hashed negative dentry. Ceph already uses the correct pattern elsewhere: ceph_fill_trace() only calls d_add(dn, NULL) for a negative null-dentry reply when d_unhashed(dn) is true. Fix both fs/ceph/dir.c sites the same way: only call d_add() for a negative dentry when it is actually unhashed. If the negative dentry is already hashed, leave it in place and reuse it as-is. This preserves the existing behavior for unhashed dentries while avoiding d_hash list corruption for reused hashed negatives.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2817b000b02c5f0c05af67c01fb2684e1381d6ef , < 4147ae08824cc8b65d2b2018f79d416af2937108 (git)
Affected: 2817b000b02c5f0c05af67c01fb2684e1381d6ef , < 73b47a1f06dee5e61b00dee5227d75d3f1f6d977 (git)
Affected: 2817b000b02c5f0c05af67c01fb2684e1381d6ef , < 79ffcbeac6bc1dc1bcdb0434acf250f6215ec111 (git)
Affected: 2817b000b02c5f0c05af67c01fb2684e1381d6ef , < 83ce43a21bb7df8dd52228afdd918d2d058eefde (git)
Affected: 2817b000b02c5f0c05af67c01fb2684e1381d6ef , < 4179cc390dacebc87079419ec92f86f3dc46294d (git)
Affected: 2817b000b02c5f0c05af67c01fb2684e1381d6ef , < b91e535f208c48a5e7464f1aa38338a30e7912df (git)
Affected: 2817b000b02c5f0c05af67c01fb2684e1381d6ef , < 2010cb06b9df7d3c816c78358c566bdacbdf38ff (git)
Affected: 2817b000b02c5f0c05af67c01fb2684e1381d6ef , < 803447f93d75ab6e40c85e6d12b5630d281d70d6 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.34
Unaffected: 0 , < 2.6.34 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.140 , ≤ 6.6.* (semver)
Unaffected: 6.12.86 , ≤ 6.12.* (semver)
Unaffected: 6.18.27 , ≤ 6.18.* (semver)
Unaffected: 7.0.4 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4147ae08824cc8b65d2b2018f79d416af2937108",
              "status": "affected",
              "version": "2817b000b02c5f0c05af67c01fb2684e1381d6ef",
              "versionType": "git"
            },
            {
              "lessThan": "73b47a1f06dee5e61b00dee5227d75d3f1f6d977",
              "status": "affected",
              "version": "2817b000b02c5f0c05af67c01fb2684e1381d6ef",
              "versionType": "git"
            },
            {
              "lessThan": "79ffcbeac6bc1dc1bcdb0434acf250f6215ec111",
              "status": "affected",
              "version": "2817b000b02c5f0c05af67c01fb2684e1381d6ef",
              "versionType": "git"
            },
            {
              "lessThan": "83ce43a21bb7df8dd52228afdd918d2d058eefde",
              "status": "affected",
              "version": "2817b000b02c5f0c05af67c01fb2684e1381d6ef",
              "versionType": "git"
            },
            {
              "lessThan": "4179cc390dacebc87079419ec92f86f3dc46294d",
              "status": "affected",
              "version": "2817b000b02c5f0c05af67c01fb2684e1381d6ef",
              "versionType": "git"
            },
            {
              "lessThan": "b91e535f208c48a5e7464f1aa38338a30e7912df",
              "status": "affected",
              "version": "2817b000b02c5f0c05af67c01fb2684e1381d6ef",
              "versionType": "git"
            },
            {
              "lessThan": "2010cb06b9df7d3c816c78358c566bdacbdf38ff",
              "status": "affected",
              "version": "2817b000b02c5f0c05af67c01fb2684e1381d6ef",
              "versionType": "git"
            },
            {
              "lessThan": "803447f93d75ab6e40c85e6d12b5630d281d70d6",
              "status": "affected",
              "version": "2817b000b02c5f0c05af67c01fb2684e1381d6ef",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.34"
            },
            {
              "lessThan": "2.6.34",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.86",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: only d_add() negative dentries when they are unhashed\n\nCeph can call d_add(dentry, NULL) on a negative dentry that is already\npresent in the primary dcache hash.\n\nIn the current VFS that is not safe.  d_add() goes through __d_add()\nto __d_rehash(), which unconditionally reinserts dentry-\u003ed_hash into\nthe hlist_bl bucket.  If the dentry is already hashed, reinserting the\nsame node can corrupt the bucket, including creating a self-loop.\nOnce that happens, __d_lookup() can spin forever in the hlist_bl walk,\ntypically looping only on the d_name.hash mismatch check and\neventually triggering RCU stall reports like this one:\n\n rcu: INFO: rcu_sched self-detected stall on CPU\n rcu:         87-....: (2100 ticks this GP) idle=3a4c/1/0x4000000000000000 softirq=25003319/25003319 fqs=829\n rcu:         (t=2101 jiffies g=79058445 q=698988 ncpus=192)\n CPU: 87 UID: 2952868916 PID: 3933303 Comm: php-cgi8.3 Not tainted 6.18.17-i1-amd #950 NONE\n Hardware name: Dell Inc. PowerEdge R7615/0G9DHV, BIOS 1.6.6 09/22/2023\n RIP: 0010:__d_lookup+0x46/0xb0\n Code: c1 e8 07 48 8d 04 c2 48 8b 00 49 89 fc 49 89 f5 48 89 c3 48 83 e3 fe 48 83 f8 01 77 0f eb 2d 0f 1f 44 00 00 48 8b 1b 48 85 db \u003c74\u003e 20 39 6b 18 75 f3 48 8d 7b 78 e8 ba 85 d0 00 4c 39 63 10 74 1f\n RSP: 0018:ff745a70c8253898 EFLAGS: 00000282\n RAX: ff26e470054cb208 RBX: ff26e470054cb208 RCX: 000000006e958966\n RDX: ff26e48267340000 RSI: ff745a70c82539b0 RDI: ff26e458f74655c0\n RBP: 000000006e958966 R08: 0000000000000180 R09: 9cd08d909b919a89\n R10: ff26e458f74655c0 R11: 0000000000000000 R12: ff26e458f74655c0\n R13: ff745a70c82539b0 R14: d0d0d0d0d0d0d0d0 R15: 2f2f2f2f2f2f2f2f\n FS:  00007f5770896980(0000) GS:ff26e482c5d88000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f5764de50c0 CR3: 000000a72abb5001 CR4: 0000000000771ef0\n PKRU: 55555554\n Call Trace:\n  \u003cTASK\u003e\n  lookup_fast+0x9f/0x100\n  walk_component+0x1f/0x150\n  link_path_walk+0x20e/0x3d0\n  path_lookupat+0x68/0x180\n  filename_lookup+0xdc/0x1e0\n  vfs_statx+0x6c/0x140\n  vfs_fstatat+0x67/0xa0\n  __do_sys_newfstatat+0x24/0x60\n  do_syscall_64+0x6a/0x230\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThis is reachable with reused cached negative dentries.  A Ceph lookup\nor atomic_open can be handed a negative dentry that is already hashed,\nand fs/ceph/dir.c then hits one of two paths that incorrectly assume\n\"negative\" also means \"unhashed\":\n\n  - ceph_finish_lookup():\n      MDS reply is -ENOENT with no trace\n      -\u003e d_add(dentry, NULL)\n\n  - ceph_lookup():\n      local ENOENT fast path for a complete directory with shared caps\n      -\u003e d_add(dentry, NULL)\n\nBoth paths can therefore re-add an already-hashed negative dentry.\n\nCeph already uses the correct pattern elsewhere: ceph_fill_trace() only\ncalls d_add(dn, NULL) for a negative null-dentry reply when d_unhashed(dn)\nis true.\n\nFix both fs/ceph/dir.c sites the same way: only call d_add() for a\nnegative dentry when it is actually unhashed.  If the negative dentry\nis already hashed, leave it in place and reuse it as-is.\n\nThis preserves the existing behavior for unhashed dentries while\navoiding d_hash list corruption for reused hashed negatives."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Ceph is a network filesystem client; the vulnerable `ceph_finish_lookup()` path is driven directly by remote MDS reply data (-ENOENT with no trace), so a malicious/compromised MDS or on-path attacker injecting crafted replies can drive the buggy `d_add()` on a hashed negative dentry. Processing remote-peer data places this at Network.\nAC:L - The corruption arose naturally in production from an ordinary `newfstatat`, showing the precondition (a reused already-hashed negative dentry) is reliably reachable; an attacker controlling MDS replies/lease grants can deterministically set up the cached negative dentry and re-lookup with no race outside their control.\nPR:N - A network attacker who controls or impersonates the MDS (or MITMs the unauthenticated msgr path) needs no privileges or credentials on the victim client to feed the -ENOENT-no-trace replies that trigger the vulnerable code.\nUI:N - On an established Ceph mount, path lookups/stats occur continuously as part of normal operation, so no specific victim action is required at exploit time.\nS:U - The corruption and resulting hang are entirely within the kernel\u0027s own dcache; no security boundary (VM, IOMMU, sandbox) is crossed.\nC:N - The bug creates a self-referential cycle in an hlist_bl hash bucket and leaks no memory contents; there is no out-of-bounds or use-after-free read primitive.\nI:N - The only state altered is an internal dcache list pointer forming a loop; this provides no attacker-controllable write primitive and modifies no user or security-relevant data.\nA:H - `__d_lookup()` spins forever on the corrupted bucket, producing RCU stalls and a hung/softlocked CPU \u2014 a kernel-level denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:29:20.131Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4147ae08824cc8b65d2b2018f79d416af2937108"
        },
        {
          "url": "https://git.kernel.org/stable/c/73b47a1f06dee5e61b00dee5227d75d3f1f6d977"
        },
        {
          "url": "https://git.kernel.org/stable/c/79ffcbeac6bc1dc1bcdb0434acf250f6215ec111"
        },
        {
          "url": "https://git.kernel.org/stable/c/83ce43a21bb7df8dd52228afdd918d2d058eefde"
        },
        {
          "url": "https://git.kernel.org/stable/c/4179cc390dacebc87079419ec92f86f3dc46294d"
        },
        {
          "url": "https://git.kernel.org/stable/c/b91e535f208c48a5e7464f1aa38338a30e7912df"
        },
        {
          "url": "https://git.kernel.org/stable/c/2010cb06b9df7d3c816c78358c566bdacbdf38ff"
        },
        {
          "url": "https://git.kernel.org/stable/c/803447f93d75ab6e40c85e6d12b5630d281d70d6"
        }
      ],
      "title": "ceph: only d_add() negative dentries when they are unhashed",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46052",
    "datePublished": "2026-05-27T12:57:10.777Z",
    "dateReserved": "2026-05-13T15:03:33.094Z",
    "dateUpdated": "2026-08-05T12:29:20.131Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46052",
      "date": "2026-09-15",
      "epss": "0.00501",
      "percentile": "0.41483"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-09T14:42:29.000Z",
      "cve": "CVE-2026-46052",
      "id": "msrc_CVE-2026-46052",
      "initial_release_date": "2026-05-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ceph: only d_add() negative dentries when they are unhashed",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-46052.json",
      "version": "4"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46052\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-27T14:17:24.807\",\"lastModified\":\"2026-06-19T13:16:32.420\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nceph: only d_add() negative dentries when they are unhashed\\n\\nCeph can call d_add(dentry, NULL) on a negative dentry that is already\\npresent in the primary dcache hash.\\n\\nIn the current VFS that is not safe.  d_add() goes through __d_add()\\nto __d_rehash(), which unconditionally reinserts dentry-\u003ed_hash into\\nthe hlist_bl bucket.  If the dentry is already hashed, reinserting the\\nsame node can corrupt the bucket, including creating a self-loop.\\nOnce that happens, __d_lookup() can spin forever in the hlist_bl walk,\\ntypically looping only on the d_name.hash mismatch check and\\neventually triggering RCU stall reports like this one:\\n\\n rcu: INFO: rcu_sched self-detected stall on CPU\\n rcu:         87-....: (2100 ticks this GP) idle=3a4c/1/0x4000000000000000 softirq=25003319/25003319 fqs=829\\n rcu:         (t=2101 jiffies g=79058445 q=698988 ncpus=192)\\n CPU: 87 UID: 2952868916 PID: 3933303 Comm: php-cgi8.3 Not tainted 6.18.17-i1-amd #950 NONE\\n Hardware name: Dell Inc. PowerEdge R7615/0G9DHV, BIOS 1.6.6 09/22/2023\\n RIP: 0010:__d_lookup+0x46/0xb0\\n Code: c1 e8 07 48 8d 04 c2 48 8b 00 49 89 fc 49 89 f5 48 89 c3 48 83 e3 fe 48 83 f8 01 77 0f eb 2d 0f 1f 44 00 00 48 8b 1b 48 85 db \u003c74\u003e 20 39 6b 18 75 f3 48 8d 7b 78 e8 ba 85 d0 00 4c 39 63 10 74 1f\\n RSP: 0018:ff745a70c8253898 EFLAGS: 00000282\\n RAX: ff26e470054cb208 RBX: ff26e470054cb208 RCX: 000000006e958966\\n RDX: ff26e48267340000 RSI: ff745a70c82539b0 RDI: ff26e458f74655c0\\n RBP: 000000006e958966 R08: 0000000000000180 R09: 9cd08d909b919a89\\n R10: ff26e458f74655c0 R11: 0000000000000000 R12: ff26e458f74655c0\\n R13: ff745a70c82539b0 R14: d0d0d0d0d0d0d0d0 R15: 2f2f2f2f2f2f2f2f\\n FS:  00007f5770896980(0000) GS:ff26e482c5d88000(0000) knlGS:0000000000000000\\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n CR2: 00007f5764de50c0 CR3: 000000a72abb5001 CR4: 0000000000771ef0\\n PKRU: 55555554\\n Call Trace:\\n  \u003cTASK\u003e\\n  lookup_fast+0x9f/0x100\\n  walk_component+0x1f/0x150\\n  link_path_walk+0x20e/0x3d0\\n  path_lookupat+0x68/0x180\\n  filename_lookup+0xdc/0x1e0\\n  vfs_statx+0x6c/0x140\\n  vfs_fstatat+0x67/0xa0\\n  __do_sys_newfstatat+0x24/0x60\\n  do_syscall_64+0x6a/0x230\\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n\\nThis is reachable with reused cached negative dentries.  A Ceph lookup\\nor atomic_open can be handed a negative dentry that is already hashed,\\nand fs/ceph/dir.c then hits one of two paths that incorrectly assume\\n\\\"negative\\\" also means \\\"unhashed\\\":\\n\\n  - ceph_finish_lookup():\\n      MDS reply is -ENOENT with no trace\\n      -\u003e d_add(dentry, NULL)\\n\\n  - ceph_lookup():\\n      local ENOENT fast path for a complete directory with shared caps\\n      -\u003e d_add(dentry, NULL)\\n\\nBoth paths can therefore re-add an already-hashed negative dentry.\\n\\nCeph already uses the correct pattern elsewhere: ceph_fill_trace() only\\ncalls d_add(dn, NULL) for a negative null-dentry reply when d_unhashed(dn)\\nis true.\\n\\nFix both fs/ceph/dir.c sites the same way: only call d_add() for a\\nnegative dentry when it is actually unhashed.  If the negative dentry\\nis already hashed, leave it in place and reuse it as-is.\\n\\nThis preserves the existing behavior for unhashed dentries while\\navoiding d_hash list corruption for reused hashed negatives.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ceph/dir.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2817b000b02c5f0c05af67c01fb2684e1381d6ef\",\"lessThan\":\"4147ae08824cc8b65d2b2018f79d416af2937108\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2817b000b02c5f0c05af67c01fb2684e1381d6ef\",\"lessThan\":\"73b47a1f06dee5e61b00dee5227d75d3f1f6d977\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2817b000b02c5f0c05af67c01fb2684e1381d6ef\",\"lessThan\":\"79ffcbeac6bc1dc1bcdb0434acf250f6215ec111\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2817b000b02c5f0c05af67c01fb2684e1381d6ef\",\"lessThan\":\"83ce43a21bb7df8dd52228afdd918d2d058eefde\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2817b000b02c5f0c05af67c01fb2684e1381d6ef\",\"lessThan\":\"4179cc390dacebc87079419ec92f86f3dc46294d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2817b000b02c5f0c05af67c01fb2684e1381d6ef\",\"lessThan\":\"b91e535f208c48a5e7464f1aa38338a30e7912df\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2817b000b02c5f0c05af67c01fb2684e1381d6ef\",\"lessThan\":\"2010cb06b9df7d3c816c78358c566bdacbdf38ff\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2817b000b02c5f0c05af67c01fb2684e1381d6ef\",\"lessThan\":\"803447f93d75ab6e40c85e6d12b5630d281d70d6\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ceph/dir.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.34\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.34\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.259\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.210\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.176\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.140\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.86\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.27\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.4\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.34.1\",\"versionEndExcluding\":\"6.6.140\",\"matchCriteriaId\":\"86294DD1-E89E-436E-80BC-95171A8D719F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.86\",\"matchCriteriaId\":\"55DA1C62-9991-451E-B8A8-E0004E00F789\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.27\",\"matchCriteriaId\":\"A10AC84F-C058-47D5-85B4-E6E51A613B74\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.4\",\"matchCriteriaId\":\"CDB78D6D-22C3-4154-B0D0-94AF1CE5C2E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.34:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"A3B1BC1D-ED46-4364-A1D9-1FA74182B03A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.34:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"86D3F64C-3F27-43E0-B0D4-62CE1E1F4EFB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.34:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"7927713B-5EB0-41EB-86A9-9935775162E0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.34:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"59037296-3143-4FBB-AFF7-D4FE2C85502F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.34:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"9CA27FD5-7DBF-4C85-80A9-D523B2E4B033\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.34:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"9711E333-A8E7-4F4B-BCFD-2023E889651A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.34:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"E04D3358-973B-42A1-8E08-2E3AE947193C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2010cb06b9df7d3c816c78358c566bdacbdf38ff\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4147ae08824cc8b65d2b2018f79d416af2937108\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4179cc390dacebc87079419ec92f86f3dc46294d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/73b47a1f06dee5e61b00dee5227d75d3f1f6d977\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/79ffcbeac6bc1dc1bcdb0434acf250f6215ec111\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/803447f93d75ab6e40c85e6d12b5630d281d70d6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/83ce43a21bb7df8dd52228afdd918d2d058eefde\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b91e535f208c48a5e7464f1aa38338a30e7912df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:50:47+00:00",
      "cve": "CVE-2026-46052",
      "id": "CVE-2026-46052",
      "initial_release_date": "2026-05-27T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ceph: only d_add() negative dentries when they are unhashed",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46052.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-09T00:19:39Z",
      "cve": "CVE-2026-46052",
      "id": "CVE-2026-46052",
      "initial_release_date": "2026-05-28T03:53:37Z",
      "product_status:known_affected": "513",
      "product_status:known_not_affected": "64",
      "product_status:recommended": "301",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-46052",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-46052.json",
      "version": "23"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.