CVE-2026-43420 Linux CVE debrief

Who should care

Linux distribution maintainers, kernel operators, and teams running Ceph-mounted filesystems on Linux should pay attention, especially if async unlink activity is common or kernel warnings are monitored as service-impact signals.

Technical summary

The vulnerable path is in the Linux kernel Ceph client. During async unlink, `ceph_unlink()` submits `CEPH_MDS_OP_UNLINK` and does not wait for completion before calling `drop_nlink()`. In the window between submission and the local decrement, worker-thread processing of capability grants, imports, or the unlink reply can run `set_nlink()` and update the inode link count. If that updated value is already zero, the subsequent decrement in `drop_nlink()` underruns the counter and can emit a WARNING at `fs/inode.c:407`. The source description says the fix is to avoid decrementing when the count is already zero, with locking around `i_nlink` updates using `ceph_inode_info.i_ceph_lock` to prevent TOCTOU races.

Defensive priority

Medium

Recommended defensive actions

• Apply the upstream/stable Linux kernel fix for CVE-2026-43420 in any kernel that includes the Ceph client async unlink path.
• Prioritize patching hosts that mount Ceph filesystems and generate frequent unlink activity, since the issue is in the Ceph client path.
• Review kernel logs for `drop_nlink()` warnings and Ceph unlink-related stack traces as indicators of exposure.
• Validate vendor kernel backports against the referenced stable kernel fixes before rollout.
• If you maintain custom Ceph client or kernel changes, avoid ad hoc workarounds and align with the locking-based fix described in the source record.

Evidence notes

The supplied CVE description states that the Linux kernel Ceph client can underrun `i_nlink` during async unlink when concurrent worker activity updates the inode before `drop_nlink()` runs, producing a WARNING in `drop_nlink+0x50/0x68`. The CVE record was published on 2026-05-08 and modified on 2026-05-12; NVD listed the item as undergoing analysis in the supplied source snapshot. The record includes multiple upstream/stable kernel references, supporting that a kernel-side fix exists or was tracked in stable branches.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.