CVE-2026-80528

In the Linux kernel, the following vulnerability has been resolved:

ceph: avoid fs reclaim while using current->journal_info

handle_reply() stores a cephmdsrequest pointer in

current->journal_info while filling the inode and dentry cache from

an MDS reply.

An allocation in this section can enter direct reclaim and prune

dentries from another filesystem.  If this dirties an ext4 inode, ext4

starts a JBD2 transaction.  JBD2 interprets the Ceph request in

current->journal_info as a journal handle and dereferences the

request's r_tid as h_transaction, causing a kernel crash, e.g.:

 Unable to handle kernel paging request at virtual address 00000000077b4818

 [...]

 Internal error: Oops: 0000000096000004 [#1]  SMP

 Modules linked in:

 CPU: 6 UID: 0 PID: 2699135 Comm: kworker/6:3 Tainted: G        W           6.18.38-i3 #1113 NONE

 [...]

 Workqueue: ceph-msgr cephconworkfn

 pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)

 pc : jbd2_journalstart+0x2c/0x208

 lr : _ext4journalstartsb+0x100/0x178

 [...]

 Call trace:

  jbd2_journalstart+0x2c/0x208 (P)

  _ext4journalstartsb+0x100/0x178

  ext4dirtyinode+0x3c/0x90

  _markinode_dirty+0x58/0x400

  iput.part.0+0x2b0/0x370

  iput+0x18/0x30

  dentryunlinkinode+0xc0/0x158

  _dentrykill+0x80/0x250

  shrinkdentrylist+0x90/0x130

  prunedcachesb+0x60/0x98

  supercachescan+0xe8/0x190

  doshrinkslab+0x174/0x388

  shrink_slab+0xd8/0x4c0

  shrink_node+0x31c/0x908

  dotrytofreepages+0xd0/0x508

  trytofree_pages+0x11c/0x238

  _allocfrozenpagesnoprof+0x4d0/0xdd0

  _folioalloc_noprof+0x18/0x70

  _filemapget_folio+0x248/0x440

  cephreaddirprepopulate+0x570/0x9e8

  mds_dispatch+0x1424/0x1ba0

  cephconprocess_message+0x74/0xa0

  cephconv1tryread+0x3a0/0x1510

  cephconworkfn+0x260/0x460

Enter a scoped NOFS allocation context and leave it after clearing

journal_info.  This prevents filesystem reclaim from recursing into

another filesystem while the field contains Ceph-private data.