PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46052 Linux CVE debrief

A vulnerability in the Linux kernel's Ceph filesystem client (fs/ceph/dir.c) allows re-insertion of already-hashed negative dentries into the dcache hash bucket, causing kernel list corruption and potential RCU stalls. The issue occurs when ceph_finish_lookup() or ceph_lookup() calls d_add(dentry, NULL) on negative dentries that are already present in the primary dcache hash. This re-insertion creates self-loops in the hlist_bl bucket, causing __d_lookup() to spin indefinitely and trigger RCU stall warnings. The fix ensures d_add() is only called for negative dentries when d_unhashed() returns true, matching the existing safe pattern used in ceph_fill_trace().

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-19
Advisory published
2026-05-27
Advisory updated
2026-06-19

Who should care

Linux kernel maintainers; organizations running Ceph storage clusters; security teams monitoring for kernel RCU stall anomalies; distribution vendors packaging kernel updates

Technical summary

The Ceph filesystem client in the Linux kernel incorrectly assumes that negative dentries are always unhashed when calling d_add(dentry, NULL). Two code paths—ceph_finish_lookup() on MDS ENOENT replies and ceph_lookup() on local fast-path ENOENT—can re-add already-hashed negative dentries. This triggers __d_rehash() to insert the same hlist_bl node twice, corrupting the bucket structure and creating self-loops. The corruption manifests as infinite loops in __d_lookup(), detected as RCU scheduler stalls. The fix adds d_unhashed() guards before d_add() calls, preserving existing behavior for unhashed dentries while preventing corruption of reused hashed negatives.

Defensive priority

high

Recommended defensive actions

  • Apply kernel patches from stable branches when available
  • Monitor NVD for CVSS assignment
  • Prioritize patching systems with Ceph filesystem mounts
  • Watch for kernel vendor security advisories (Red Hat, SUSE, Ubuntu, Debian)
  • Review systems for RCU stall warnings in dmesg/logs as potential exploitation indicator

Evidence notes

CVE published 2026-05-27T14:17:24.807Z; modified 2026-05-27T14:48:03.013Z. Five kernel.org stable branch commits provided as references. No CVSS score assigned; NVD status 'Awaiting Analysis'.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46052 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46052

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46052 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46052

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2010cb06b9df7d3c816c78358c566bdacbdf38ff

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4179cc390dacebc87079419ec92f86f3dc46294d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/803447f93d75ab6e40c85e6d12b5630d281d70d6

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/83ce43a21bb7df8dd52228afdd918d2d058eefde

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b91e535f208c48a5e7464f1aa38338a30e7912df

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.