CVE-2026-23047
Description
A deadlock vulnerability was found in the Linux kernel's Ceph client library (libceph). The calc_target() function clears the paused flag for requests but never sets it for linger requests, as that logic was only in __submit_request(). When watch requests are paused long enough to timeout and need reestablishment, they never get marked as paused and thus never get resent when unpaused. This causes rbd_reregister_watch() to wait indefinitely with rbd_dev->watch_mutex held.
Statement
This vulnerability affects systems using Ceph RBD (RADOS Block Device) storage. When network conditions cause watch requests to be paused for extended periods, the subsequent deadlock prevents RBD images from being unmapped, causing "rbd unmap" commands to hang in D state. Recovery requires a system reboot.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Other); DoS: Crash, Exit, or Restart
Each thread of execution will "hang" and prevent tasks from completing. In some cases, CPU consumption may occur if a lock check occurs in a tight loop.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
