CVE-2026-23201: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23201 is a kernel oops vulnerability in the Linux kernel's CephFS filesystem implementation, specifically within the parse_longname() function, triggered when listing ceph snapshot directories (e.g., ls /mnt/myceph/.snap). It was published on February 14, 2026, and affects Linux kernel versions 6.12.42–6.12.69, 6.15.10–6.15.x, 6.16.1–6.18.9, and 6.19-rc1 through 6.19-rc8. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is an invalid pointer passed to kfree() (classified as CWE-476, NULL Pointer Dereference). In parse_longname(), the pointer variable str is managed by the __free(kfree) cleanup attribute, but is incremented by one byte to skip the leading underscore (_) in CephFS snapshot names. When the function returns, kfree() is called with the advanced (off-by-one) pointer rather than the original allocation address, causing a kernel panic. Exploitation requires only local access with low privileges — any user able to list a .snap directory on an affected CephFS mount can trigger the oops (Feedly, Kernel Patch 1).

Successful exploitation causes a kernel oops/panic, resulting in a denial of service — the system may hang indefinitely (e.g., ls hangs forever) or require a reboot. There is no confidentiality or integrity impact; the sole consequence is high availability impact. The issue is particularly disruptive when CephFS mounts are configured in /etc/fstab, as the system may become unresponsive during boot if snapshot directories are accessed automatically (Feedly).

1. Identify a vulnerable system: Confirm the target is running a Linux kernel version between 6.12.42–6.12.69, 6.15.10–6.15.x, 6.16.1–6.18.9, or 6.19-rc1 through 6.19-rc8 with a CephFS filesystem mounted.
2. Obtain local access: Gain low-privilege local access to the system (e.g., via SSH with a standard user account).
3. Locate the CephFS mount: Identify the CephFS mount point by running mount | grep ceph or checking /etc/fstab.
4. Trigger the vulnerability: Execute ls /mnt/<cephfs_mountpoint>/.snap where the CephFS volume has one or more snapshots. This causes parse_longname() to be invoked with snapshot names, triggering the invalid kfree() call.
5. Observe kernel oops: The kernel panics or hangs; the ls command hangs indefinitely and the kernel log displays an oops message, resulting in denial of service (Feedly).

• Logs: Kernel oops or panic messages in /var/log/kern.log or dmesg output referencing parse_longname() in the ceph filesystem module; messages such as BUG: unable to handle kernel NULL pointer dereference or general protection fault associated with ceph kernel code.
• Process: A ls or similar directory-listing process hanging indefinitely in an uninterruptible sleep state (D state in ps aux) when accessing a .snap directory on a CephFS mount.
• System Behavior: System becomes unresponsive or requires a hard reboot; CephFS mounts become inaccessible after the oops (Feedly).

Patches were released on March 19, 2026, targeting the affected kernel stable branches via three commits: 8c9af73, bc8dedae, and e258ed36. Downstream distributions including Debian, SUSE, and Oracle Linux have issued updated kernel packages. As a workaround prior to patching, restrict user access to CephFS .snap directories using filesystem-level access controls, or avoid mounting CephFS volumes with snapshots on affected kernel versions. Scheduling a kernel update and system reboot at the earliest maintenance window is the recommended remediation (Feedly, SUSE Advisory).

Debian issued a security advisory (DSA-6141-1) covering this vulnerability, and SUSE released advisory SUSE-SU-2026:1661-1 with updated kernel packages. Oracle Linux also published errata (ELSA-2026-50160 and ELSA-2026-50232) addressing the issue. Tenable's Nessus scanner added detection plugins (IDs 299103, 303468, 309153) for this CVE. No notable researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking (Feedly, SUSE Advisory).