CVE-2026-64112
Description
A flaw was found in the Linux kernel's Rados Block Device (RBD) module. A race condition exists in the lock_dwork draining mechanism during the unmapping of an image. This allows the lock_dwork to be re-queued after it is expected to be finalized, potentially leading to rbd_acquire_lock() executing on freed or reset resources. This can result in a violated assertion within the kernel, causing system instability or a denial of service.
Statement
A race in the RBD unmap path can let lock_dwork be requeued while exclusive lock work is being drained. This can allow rbd_acquire_lock and follow up lock handling to run after rbd_dev_device_release and rbd_dev_image_release have freed or reset image resources, creating a plausible use-after-free condition or kernel crash. For the CVSS the PR:L is used in the paranoid score because reliable triggering may be possible by a local user or service account with delegated RBD map or unmap control, even though typical systems restrict this path to root or CAP_SYS_ADMIN. The issue is not directly network reachable because the trigger is local RBD device control rather than incoming Ceph traffic, although backend network timing may influence the race window. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to use-after-free in kernel workqueue context.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.7 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | High | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
