CVE-2026-80527

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix hanging __ceph_get_caps() with stale mds_wanted

A reader can hang forever in __ceph_get_caps() when the client no

longer holds `FILE_RD`, but local cap state still says that the

capability is already wanted (via `mds_wanted`).

One way to trigger this is through MDS cap revocation. If another

client performs a conflicting operation, the MDS can revoke `FILE_RD`

from the reader; the next read then has to reacquire `FILE_RD`. If

the cap update that should request `FILE_RD` never reaches the MDS

after `cap->mds_wanted` was raised, the reader is left holding only

non-file caps while local `mds_wanted` still includes the file read

caps.

In that state, try_get_cap_refs() sees `need <= mds_wanted` and

returns 0, so __ceph_get_caps() just waits on `i_cap_wq`. If the cap

update that was supposed to request `FILE_RD never reaches the MDS

after `cap->mds_wanted was` raised, no further request is sent and the

waite

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References