CVE-2026-90042: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-90042 is a kernel crash (denial of service) vulnerability in the Linux kernel's Ceph filesystem implementation, caused by improper handling of filename decryption when messenger buffers are allocated in the vmalloc() memory region. The fscrypt subsystem requires buffers to reside in the linear mapping region for its scatterlist crypto API, but the Ceph messenger client uses kvmalloc(), which may place buffers in vmalloc() under memory fragmentation conditions. This mismatch causes kernel oopses (crashes) particularly on non-x86 platforms. Affected kernel versions begin at commit 457117f077c6 through Linux 6.6 and later, with fixes available in stable commits and kernel versions 6.18.51+, 7.2.5+, and 7.3-rc1+. The NVD-assigned CVSS v3.1 base score is 9.8 (Critical), though the actual impact is primarily denial of service (GitHub Advisory).

The root cause is an improper memory handling issue (no CWE formally assigned) in ceph_fname_to_usr(), which accepts raw MDS message buffers — potentially vmalloc()-allocated — and passes them directly to fscrypt_fname_disk_to_usr(). The fscrypt subsystem's scatterlist crypto API mandates that all input buffers reside in the kernel's linear mapping region; vmalloc() addresses violate this constraint, triggering kernel oopses. The fix introduces a bounce buffer (tname) in ceph_fname_to_usr() to transparently copy vmalloc()-region data into a linearly-mapped buffer before passing it to fscrypt, and updates parse_reply_info_readdir() to pass NULL for tname when the message is not in the linear region, triggering a per-dentry kmalloc()+kfree() as needed (GitHub Advisory).

Successful triggering of this vulnerability causes kernel oopses (crashes), resulting in a denial of service for any system running a Ceph filesystem with fscrypt-encrypted filenames. The impact is most severe on non-x86 platforms where vmalloc() buffer placement is more common due to stricter memory mapping constraints. While the NVD CVSS score rates confidentiality and integrity impacts as High, the practical impact is availability loss through kernel crashes; there is no demonstrated path to code execution or data exfiltration (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the disclosure date (GitHub Advisory). The vulnerability is network-accessible and requires no authentication, as any client interacting with a Ceph MDS over a network can trigger the condition by causing readdir or filename lookup operations on fscrypt-encrypted directories under memory fragmentation conditions. The CVE status is listed as "Received" and it is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No EPSS score data was available at time of reporting.

• Logs: Kernel oops/panic messages in /var/log/kern.log or dmesg output referencing ceph_fname_to_usr, fscrypt_fname_disk_to_usr, or scatterlist crypto API failures on non-linear addresses.
• System Behavior: Unexpected kernel crashes or reboots on systems running Ceph filesystems with fscrypt encryption, particularly on non-x86 architectures (e.g., ARM64, RISC-V).
• Process: Ceph client processes (ceph-fuse, kernel CephFS mounts) becoming unresponsive or triggering kernel BUG/oops traces during directory listing (readdir) operations on encrypted directories.

Update the Linux kernel to a patched version: stable commits 110747ff535e, 3b467c68803d, or e939fc6a7bd9 address the issue, corresponding to kernel releases 6.18.51+, 7.2.5+, and 7.3-rc1+ (GitHub Advisory). As a temporary workaround where patching is not immediately possible, administrators can avoid using fscrypt-encrypted directories on Ceph filesystems, or restrict Ceph deployments to x86 platforms where vmalloc() buffer placement is less likely to trigger the issue. Monitoring kernel logs for oops messages related to Ceph and fscrypt is recommended until patching is complete.