CVE-2026-46052

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ceph: only d_add() negative dentries when they are unhashed

Ceph can call d_add(dentry, NULL) on a negative dentry that is already

present in the primary dcache hash.

In the current VFS that is not safe. d_add() goes through __d_add()

to __d_rehash(), which unconditionally reinserts dentry->d_hash into

the hlist_bl bucket. If the dentry is already hashed, reinserting the

same node can corrupt the bucket, including creating a self-loop.

Once that happens, __d_lookup() can spin forever in the hlist_bl walk,

typically looping only on the d_name.hash mismatch check and

eventually triggering RCU stall reports like this one:

rcu: INFO: rcu_sched self-detected stall on CPU

rcu: 87-....: (2100 ticks this GP) idle=3a4c/1/0x4000000000000000 softirq=25003319/25003319 fqs=829

rcu: (t=2101 jiffies g=79058445 q=698988 ncpus=192)

CPU: 87 UID: 2952868916 PID: 3933303 Comm: php-cgi8.3 Not tainted 6.18.17-i1-am

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References