{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nceph: only d_add() negative dentries when they are unhashed\\n\\nCeph can call d_add(dentry, NULL) on a negative dentry that is already\\npresent in the primary dcache hash.\\n\\nIn the current VFS that is not safe. d_add() goes through __d_add()\\nto __d_rehash(), which unconditionally reinserts dentry-\\u003ed_hash into\\nthe hlist_bl bucket. If the dentry is already hashed, reinserting the\\nsame node can corrupt the bucket, including creating a self-loop.\\nOnce that happens, __d_lookup() can spin forever in the hlist_bl walk,\\ntypically looping only on the d_name.hash mismatch check and\\neventually triggering RCU stall reports like this one:\\n\\n rcu: INFO: rcu_sched self-detected stall on CPU\\n rcu: 87-….: (2100 ticks this GP) idle=3a4c\/1\/0x4000000000000000 softirq=25003319\/25003319 fqs=829\\n rcu: (t=2101 jiffies g=79058445 q=698988 ncpus=192)\\n CPU: 87 UID: 2952868916 PID: 3933303 Comm: php-cgi8.3 Not tainted 6.18.17-i1-amd #950 NONE\\n Hardware name: Dell Inc. PowerEdge R7615\/0G9DHV, BIOS 1.6.6 09\/22\/2023\\n RIP: 0010:__d_lookup+0x46\/0xb0\\n Code: c1 e8 07 48 8d 04 c2 48 8b 00 49 89 fc 49 89 f5 48 89 c3 48 83 e3 fe 48 83 f8 01 77 0f eb 2d 0f 1f 44 00 00 48 8b 1b 48 85 db \\u003c74\\u003e 20 39 6b 18 75 f3 48 8d 7b 78 e8 ba 85 d0 00 4c 39 63 10 74 1f\\n RSP: 0018:ff745a70c8253898 EFLAGS: 00000282\\n RAX: ff26e470054cb208 RBX: ff26e470054cb208 RCX: 000000006e958966\\n RDX: ff26e48267340000 RSI: ff745a70c82539b0 RDI: ff26e458f74655c0\\n RBP: 000000006e958966 R08: 0000000000000180 R09: 9cd08d909b919a89\\n R10: ff26e458f74655c0 R11: 0000000000000000 R12: ff26e458f74655c0\\n R13: ff745a70c82539b0 R14: d0d0d0d0d0d0d0d0 R15: 2f2f2f2f2f2f2f2f\\n FS: 00007f5770896980(0000) GS:ff26e482c5d88000(0000) knlGS:0000000000000000\\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n CR2: 00007f5764de50c0 CR3: 000000a72abb5001 CR4: 0000000000771ef0\\n PKRU: 55555554\\n Call Trace:\\n \\u003cTASK\\u003e\\n lookup_fast+0x9f\/0x100\\n walk_component+0x1f\/0x150\\n link_path_walk+0x20e\/0x3d0\\n path_lookupat+0x68\/0x180\\n filename_lookup+0xdc\/0x1e0\\n vfs_statx+0x6c\/0x140\\n vfs_fstatat+0x67\/0xa0\\n __do_sys_newfstatat+0x24\/0x60\\n do_syscall_64+0x6a\/0x230\\n entry_SYSCALL_64_after_hwframe+0x76\/0x7e\\n\\nThis is reachable with reused cached negative dentries. A Ceph lookup\\nor atomic_open can be handed a negative dentry that is already hashed,\\nand fs\/ceph\/dir.c then hits one of two paths that incorrectly assume\\n\\”negative\\” also means \\”unhashed\\”:\\n\\n – ceph_finish_lookup():\\n MDS reply is -ENOENT with no trace\\n -\\u003e d_add(dentry, NULL)\\n\\n – ceph_lookup():\\n local ENOENT fast path for a complete directory with shared caps\\n -\\u003e d_add(dentry, NULL)\\n\\nBoth paths can therefore re-add an already-hashed negative dentry.\\n\\nCeph already uses the correct pattern elsewhere: ceph_fill_trace() only\\ncalls d_add(dn, NULL) for a negative null-dentry reply when d_unhashed(dn)\\nis true.\\n\\nFix both fs\/ceph\/dir.c sites the same way: only call d_add() for a\\nnegative dentry when it is actually unhashed. If the negative dentry\\nis already hashed, leave it in place and reuse it as-is.\\n\\nThis preserves the existing behavior for unhashed dentries while\\navoiding d_hash list corruption for reused hashed negatives.”,”published”:”2026-05-27T12:57:10.777Z”,”modified”:”2026-05-30T10:46:58.631Z”,”type”:”cve”,”title”:”ceph: only d_add() negative dentries when they are unhashed”,”source”:”Linux”,”references”:”https:\/\/git.kernel.org\/stable\/c\/83ce43a21bb7df8dd52228afdd918d2d058eefde\\nhttps:\/\/git.kernel.org\/stable\/c\/4179cc390dacebc87079419ec92f86f3dc46294d\\nhttps:\/\/git.kernel.org\/stable\/c\/b91e535f208c48a5e7464f1aa38338a30e7912df\\nhttps:\/\/git.kernel.org\/stable\/c\/2010cb06b9df7d3c816c78358c566bdacbdf38ff\\nhttps:\/\/git.kernel.org\/stable\/c\/803447f93d75ab6e40c85e6d12b5630d281d70d6″,”id”:”CVE-2026-46052″,”bulletinFamily”:””,”cwe”:null,”cvelist”:null,”sourceData”:”Linux Linux 2817b000b02c5f0c05af67c01fb2684e1381d6ef\\nLinux Linux 2817b000b02c5f0c05af67c01fb2684e1381d6ef\\nLinux Linux 2817b000b02c5f0c05af67c01fb2684e1381d6ef\\nLinux Linux 2817b000b02c5f0c05af67c01fb2684e1381d6ef\\nLinux Linux 2817b000b02c5f0c05af67c01fb2684e1381d6ef\\nLinux Linux 2.6.34″,”sourceHref”:””,”cvss”:{“score”:7.5,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:N\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”Linux”,”version”:”2817b000b02c5f0c05af67c01fb2684e1381d6ef”,”vendor”:”Linux”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nceph: only d_add() negative dentries when they are unhashed\\n\\nCeph can call d_add(dentry, NULL) on a negative…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,16,12,15,13,7,11,5],"class_list":["post-58577","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-75","tag-exploit","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n