CVE-2026-80528

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Ceph component where the handle reply() function stores a ceph mds request pointer in the current->journal info variable while populating the inode and dentry cache from a Metadata Server (MDS) reply. If an allocation occurs during this process, it may trigger direct reclaim, which can prune dentries from other filesystems. If this action dirties an ext4 inode, the JBD2 (Journaling Block Device) starts a transaction and incorrectly interprets the Ceph request stored in current->journal info as a journal handle. This leads to the dereferencing of the r tid variable as h transaction, resulting in a kernel crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.