{
  "threat_severity" : "Moderate",
  "public_date" : "2026-05-27T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: ceph: only d_add() negative dentries when they are unhashed",
    "id" : "2482028",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2482028"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.0",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "draft"
  },
  "cwe" : "CWE-464",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nceph: only d_add() negative dentries when they are unhashed\nCeph can call d_add(dentry, NULL) on a negative dentry that is already\npresent in the primary dcache hash.\nIn the current VFS that is not safe.  d_add() goes through __d_add()\nto __d_rehash(), which unconditionally reinserts dentry->d_hash into\nthe hlist_bl bucket.  If the dentry is already hashed, reinserting the\nsame node can corrupt the bucket, including creating a self-loop.\nOnce that happens, __d_lookup() can spin forever in the hlist_bl walk,\ntypically looping only on the d_name.hash mismatch check and\neventually triggering RCU stall reports like this one:\nrcu: INFO: rcu_sched self-detected stall on CPU\nrcu:         87-....: (2100 ticks this GP) idle=3a4c/1/0x4000000000000000 softirq=25003319/25003319 fqs=829\nrcu:         (t=2101 jiffies g=79058445 q=698988 ncpus=192)\nCPU: 87 UID: 2952868916 PID: 3933303 Comm: php-cgi8.3 Not tainted 6.18.17-i1-amd #950 NONE\nHardware name: Dell Inc. PowerEdge R7615/0G9DHV, BIOS 1.6.6 09/22/2023\nRIP: 0010:__d_lookup+0x46/0xb0\nCode: c1 e8 07 48 8d 04 c2 48 8b 00 49 89 fc 49 89 f5 48 89 c3 48 83 e3 fe 48 83 f8 01 77 0f eb 2d 0f 1f 44 00 00 48 8b 1b 48 85 db <74> 20 39 6b 18 75 f3 48 8d 7b 78 e8 ba 85 d0 00 4c 39 63 10 74 1f\nRSP: 0018:ff745a70c8253898 EFLAGS: 00000282\nRAX: ff26e470054cb208 RBX: ff26e470054cb208 RCX: 000000006e958966\nRDX: ff26e48267340000 RSI: ff745a70c82539b0 RDI: ff26e458f74655c0\nRBP: 000000006e958966 R08: 0000000000000180 R09: 9cd08d909b919a89\nR10: ff26e458f74655c0 R11: 0000000000000000 R12: ff26e458f74655c0\nR13: ff745a70c82539b0 R14: d0d0d0d0d0d0d0d0 R15: 2f2f2f2f2f2f2f2f\nFS:  00007f5770896980(0000) GS:ff26e482c5d88000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f5764de50c0 CR3: 000000a72abb5001 CR4: 0000000000771ef0\nPKRU: 55555554\nCall Trace:\n<TASK>\nlookup_fast+0x9f/0x100\nwalk_component+0x1f/0x150\nlink_path_walk+0x20e/0x3d0\npath_lookupat+0x68/0x180\nfilename_lookup+0xdc/0x1e0\nvfs_statx+0x6c/0x140\nvfs_fstatat+0x67/0xa0\n__do_sys_newfstatat+0x24/0x60\ndo_syscall_64+0x6a/0x230\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\nThis is reachable with reused cached negative dentries.  A Ceph lookup\nor atomic_open can be handed a negative dentry that is already hashed,\nand fs/ceph/dir.c then hits one of two paths that incorrectly assume\n\"negative\" also means \"unhashed\":\n- ceph_finish_lookup():\nMDS reply is -ENOENT with no trace\n-> d_add(dentry, NULL)\n- ceph_lookup():\nlocal ENOENT fast path for a complete directory with shared caps\n-> d_add(dentry, NULL)\nBoth paths can therefore re-add an already-hashed negative dentry.\nCeph already uses the correct pattern elsewhere: ceph_fill_trace() only\ncalls d_add(dn, NULL) for a negative null-dentry reply when d_unhashed(dn)\nis true.\nFix both fs/ceph/dir.c sites the same way: only call d_add() for a\nnegative dentry when it is actually unhashed.  If the negative dentry\nis already hashed, leave it in place and reuse it as-is.\nThis preserves the existing behavior for unhashed dentries while\navoiding d_hash list corruption for reused hashed negatives.", "A flaw was found in the Linux kernel's Ceph filesystem. A local user or process interacting with the Ceph filesystem could trigger a dcache hash corruption when a negative dentry is incorrectly re-added to the dcache hash while it is already present. This can cause the system to experience an RCU stall, leading to a system hang and a Denial of Service (DoS)." ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-46052\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46052\nhttps://lore.kernel.org/linux-cve-announce/2026052754-CVE-2026-46052-d212@gregkh/T" ],
  "name" : "CVE-2026-46052",
  "csaw" : false
}