CVE-2026-23047

Root

Cause

In the Linux kernel's Ceph client (libceph), the calc_target() function determines whether a request should enter a paused state. However, it only clears the t->paused flag when the request should no longer be paused; it never *sets* t->paused, even though it can detect when pausing is necessary. For ordinary requests this omission is harmless because __submit_request() sets the flag later. But for linger requests (such as watch operations), __submit_request() is not invoked, so the flag is never set [1].

Exploitation

No authentication or special privileges are required beyond the ability to trigger Ceph watch operations that become paused long enough for the unwatch request to timeout. When such a pause occurs, the subsequent (re)watch request enters the paused state but t->paused remains unset. Consequently, the request is never placed on the need_resend_linger list and is never kicked when unpaused. The function rbd_reregister_watch() hangs while holding rbd_dev->watch_mutex, waiting for linger_reg_commit_wait to complete [2].

Impact

An attacker who can cause watch requests to be paused (e.g., by manipulating network conditions or Ceph cluster state) can trigger a deadlock. The hung rbd_reregister_watch() call prevents the RBD watch from being reestablished and leaves rbd_dev->watch_mutex held indefinitely. This in turn makes it impossible to unmap the RBD image — "rbd unmap" stalls forever waiting for the mutex. The issue can lead to denial of service for any process needing to access or release RBD images [3].

Mitigation

The fix was committed to the Linux kernel stable tree in commit 4d3399c52e0e (and backports 6f468f6ff233, 2b3329b3c29d, 5647d42c47b5). Users should apply the latest stable kernel update containing these patches. No workaround is available; the vulnerability affects any kernel version lacking the fix [4].