CVE-2026-23047: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23047 is a vulnerability in the Linux kernel's libceph subsystem involving incorrect state management of the t->paused flag in the calc_target() function. The flaw causes linger requests (used for Ceph watch/notify operations) to never be marked as paused, leading to deadlocks in rbd_reregister_watch() when the rbd_dev->watch_mutex is held indefinitely. It was published on February 4, 2026, and affects the Linux kernel across multiple stable branches. The CVSS category is estimated as Medium, with an EPSS score of 0.032% (Feedly).

The root cause is a logic error in libceph's calc_target() function (net/ceph/osd_client.c), which clears t->paused when a request should be unpaused but never sets it when a request should be paused. For linger requests, __submit_request() — which normally handles setting the paused flag — is not invoked, so lreq->t.paused is never set. This means that when a paused unwatch request times out and the subsequent (re)watch request enters the paused state, it is never placed on the need_resend_linger list. Consequently, rbd_reregister_watch() blocks indefinitely waiting on lreq->reg_commit_wait, holding rbd_dev->watch_mutex and preventing further watch operations. The fix involves making calc_target() responsible for both setting and clearing t->paused (Feedly, Linux Kernel Git).

The primary impact is a denial-of-service condition on systems using Ceph RBD (RADOS Block Device) with watch/notify functionality. A deadlock in rbd_reregister_watch() causes the rbd_dev->watch_mutex to be held indefinitely, preventing watch reestablishment and potentially hanging kernel threads that depend on this mutex. This can result in loss of availability for RBD-backed storage operations, impacting workloads in environments using Ceph-backed block storage (e.g., OpenStack, Kubernetes with Ceph CSI). There is no known confidentiality or integrity impact (Feedly).

The fix has been applied to multiple Linux kernel stable branches via patches to net/ceph/osd_client.c. Downstream distributions including Amazon Linux 2 (kernel 5.10, 5.15), SUSE (SUSE-SU-2026:1661-1), Ubuntu (USN-8278-1, USN-8289-1, USN-8296-1, USN-8278-2, USN-8289-2, USN-8296-2, USN-8393-1), and Oracle Linux have released updated kernel packages. Administrators should update to the latest patched kernel version provided by their distribution. No configuration-based workaround is known; upgrading the kernel is the recommended remediation (Amazon Linux Advisory, SUSE Advisory, Ubuntu USN-8278-1).