PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-90042 Linux CVE debrief

A critical vulnerability was resolved in the Linux kernel, specifically in the ceph filesystem, where filenames in vmalloc() buffers were not properly decrypted, leading to potential system crashes, particularly on non-x86 platforms. This issue arises from the fscrypt subsystem's requirement that buffers must be in the linear mapping region, but the messenger client uses kvmalloc() to create buffers that may end up in the vmalloc() region due to physical memory fragmentation. To address this, ceph_fname_to_usr() was modified to handle vmalloc()-allocated buffers by using a bounce buffer, ensuring compatibility with fscrypt_fname_disk_to_usr(). Additionally, parse_reply_info_readdir() was updated to follow the rule that 'tname' must never come from vmalloc(), passing NULL when necessary, which may incur a minor overhead for a small fraction of readdir messages.

Vendor
Linux
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-16
Original CVE updated
2026-09-21
Advisory published
2026-09-16
Advisory updated
2026-09-21

Who should care

Linux kernel maintainers, users of ceph filesystem, and security teams responsible for maintaining and securing Linux-based systems should be aware of this vulnerability and take necessary actions to ensure system security and integrity.

Why it matters

This vulnerability in the Linux kernel's ceph filesystem could lead to system crashes or unauthorized access if not properly addressed. Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems.

  • Potential system crashes due to improper decryption of filenames in vmalloc() buffers.
  • Risk of unauthorized access or data exposure through ceph filesystem.
  • Need for verification of affected systems to ensure the applied fix is effective.

Technical summary

The Linux kernel's ceph filesystem had a vulnerability where filenames in vmalloc() buffers were not properly decrypted. This was due to the fscrypt subsystem's requirement for buffers to be in the linear mapping region. The issue was resolved by modifying ceph_fname_to_usr() to handle vmalloc()-allocated buffers and updating parse_reply_info_readdir() to follow specific rules for 'tname'. Additionally, the fix ensures that the system can properly handle filenames in vmalloc() buffers, preventing potential system crashes or unauthorized access. Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems, especially those utilizing ceph filesystem, to ensure the fix.

Defensive priority

Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems, especially those utilizing ceph filesystem, to ensure the applied fix is effective and no unauthorized access or system crashes occur.

Recommended defensive actions

  • Review and apply the provided Linux kernel patches to ensure proper decryption of filenames in vmalloc() buffers.
  • Verify that affected systems, especially those utilizing ceph filesystem, are updated with the fix.
  • Monitor system logs for any unusual activity or crashes related to ceph filesystem operations.
  • Perform a thorough review of system configurations and ensure that all necessary security measures are in place.
  • Conduct regular security audits to identify potential vulnerabilities and address them promptly.
  • Implement compensating controls, such as additional monitoring or access restrictions, for exposed systems.
  • Track and document changes to the system and verify that the applied fix is effective.

Evidence notes

The CVE record and NVD detail provide information on the vulnerability's impact and resolution. Four source references from the Linux kernel Git repository are provided, detailing the specific commits addressing the issue.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-90042 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-90042

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-90042 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-90042

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/110747ff535e3d98ac17d68dbd056bb6ef000e23

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3b467c68803d7c7e82678289e598afd44faa6101

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/93729594af506557a86f8b603be7ac5f3370eeca

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e939fc6a7bd969a58a150b7f188c1047138403e3

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.