CVE-2024-26689

What it actually does

Race condition between ceph_buffer_get in encode_cap_msg and ceph_buffer_put in handle_cap_grant allows a use-after-free on ci->i_xattrs.blob when __prep_cap assigns the buffer and __send_cap later references it.

Why it matters to the business

Systems running Ceph on Linux kernels may experience kernel crashes, memory corruption, or potential local privilege escalation, disrupting storage services and requiring urgent patching across fleets.

How an attack unfolds

An attacker with the ability to trigger Ceph capability grant/revoke operations and concurrent xattr buffer handling can win the race to free the buffer before the reference increment, leading to use-after-free memory access.

How to fix it

Upgrade the Linux kernel to the commit 8180d0c27b93a6eb60da1b08ea079e3926328214 or later stable releases that contain the fix for the refcount ordering in caps.c.

How to confirm the fix worked

Confirm the running kernel contains commit 8180d0c27b93a6eb60da1b08ea079e3926328214; review fs/ceph/caps.c for the added ceph_buffer_get before the xattr_buf reference and test with KASAN-enabled kernels under concurrent cap operations.

Typical attack path

1. Obtain local access or Ceph client privileges on an affected kernel
2. Trigger concurrent cap grant handling and cap message encoding via filesystem operations
3. Win the race so handle_cap_grant frees the xattr blob before encode_cap_msg increments its refcount
4. Access the freed memory to cause denial of service or attempt memory corruption for escalation

How to detect it

Inspect kernel logs for KASAN use-after-free reports referencing ceph_buffer_get, encode_cap_msg, handle_cap_grant, or __send_cap; correlate with Ceph capability grant activity in dmesg or system logs.

What your security team should do

• Prioritize kernel upgrades to the fixed commit across all Ceph client nodes
• Monitor for kernel oops or KASAN reports involving ceph_buffer_get or encode_cap_msg
• Apply compensating controls such as restricting untrusted local access until patches are deployed