GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80527 (GCVE-0-2026-80527)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:37 – Updated: 2026-08-27 05:01
VLAI
Title
ceph: fix hanging __ceph_get_caps() with stale mds_wanted
Summary
In the Linux kernel, the following vulnerability has been resolved: ceph: fix hanging __ceph_get_caps() with stale mds_wanted A reader can hang forever in __ceph_get_caps() when the client no longer holds `FILE_RD`, but local cap state still says that the capability is already wanted (via `mds_wanted`). One way to trigger this is through MDS cap revocation. If another client performs a conflicting operation, the MDS can revoke `FILE_RD` from the reader; the next read then has to reacquire `FILE_RD`. If the cap update that should request `FILE_RD` never reaches the MDS after `cap->mds_wanted` was raised, the reader is left holding only non-file caps while local `mds_wanted` still includes the file read caps. In that state, try_get_cap_refs() sees `need <= mds_wanted` and returns 0, so __ceph_get_caps() just waits on `i_cap_wq`. If the cap update that was supposed to request `FILE_RD never reaches the MDS after `cap->mds_wanted was` raised, no further request is sent and the waiter can sleep indefinitely until unrelated cap traffic happens to wake it up. The ordering issue is that `cap->mds_wanted` is updated in __prep_cap() before the `CEPH_MSG_CLIENT_CAPS message` is actually queued for send. That makes one field serve two different meanings at once: what this client wants, and what the client believes the MDS already knows it wants. A proper fix would be to split those states and track whether a cap update is actually in flight or has been observed by the MDS. However, simply moving the `cap->mds_wanted assignment` later would not be sufficient: queueing the message in the messenger does not guarantee that the MDS processed that specific wanted set, and reconnect or message loss can still invalidate that assumption. Fixing that properly would require a larger rework of the cap state machine. To allow simpler backports to stable kernels, this patch implements a simpler workaround: - stop waiting forever in __ceph_get_caps(); after a bounded wait, fall back to the renew path - make ceph_renew_caps() issue a synchronous `OPEN` request whenever the inode still does not actually hold the wanted caps, instead of only calling ceph_check_caps() The extra issued-vs-wanted check in ceph_renew_caps() is necessary because the previous test only checked whether the inode still had any real caps at all. That is not enough after revocation: the client can still hold something like `pLs` and yet be missing `FILE_RD` completely. In that case, falling back to ceph_check_caps() is not sufficient, because it still trusts `cap->mds_wanted` and may resend nothing. By requiring `(issued & wanted) == wanted` before taking the asynchronous path, the code only uses ceph_check_caps() when the `wanted caps` are already actually issued. Otherwise, it sends the synchronous `OPEN` renew. This preserves the existing asynchronous fast path when the wanted caps are already issued, avoids changing cap-state semantics, and fixes the hang by guaranteeing that a stalled waiter eventually retries through a path that does not rely on the stale `mds_wanted` state. [ idryomov: move CEPH_GET_CAPS_WAIT_TIMEOUT from libceph.h to mds_client.h, formatting ]
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c , < b5661524c5a45085a866864ca9b8ae2513dfd67a (git)
Affected: 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c , < 5e84bc6f67e19fdd192d8b215de728acbfc12572 (git)
Affected: 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c , < 5fedf279a1ea369d39c8b06dd4547cdc576065d0 (git)
Affected: 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c , < e05c315b4da0c16ea800ee4b2cb6c617f586d1b5 (git)
Affected: 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c , < fcce1b3be6d286aa80831e730289f4c062053ae6 (git)
Affected: 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c , < a3bc6b3e9ef3f5f5cb85a902a30a090c7931127c (git)
Affected: 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c , < 9e55fe24c548ad3163903eb58bb002d28d32a630 (git)
Affected: 0a454bdd501ad1aa30bb72e9581efa338ad6ce5c , < 50958bb928bad3bdba9e5d1b7ff4bbadcf6951e6 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.8
Unaffected: 0 , < 5.8 (semver)
Unaffected: 5.10.266 , ≤ 5.10.* (semver)
Unaffected: 5.15.217 , ≤ 5.15.* (semver)
Unaffected: 6.1.184 , ≤ 6.1.* (semver)
Unaffected: 6.6.153 , ≤ 6.6.* (semver)
Unaffected: 6.12.105 , ≤ 6.12.* (semver)
Unaffected: 6.18.46 , ≤ 6.18.* (semver)
Unaffected: 7.1.10 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/caps.c",
            "fs/ceph/file.c",
            "fs/ceph/mds_client.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b5661524c5a45085a866864ca9b8ae2513dfd67a",
              "status": "affected",
              "version": "0a454bdd501ad1aa30bb72e9581efa338ad6ce5c",
              "versionType": "git"
            },
            {
              "lessThan": "5e84bc6f67e19fdd192d8b215de728acbfc12572",
              "status": "affected",
              "version": "0a454bdd501ad1aa30bb72e9581efa338ad6ce5c",
              "versionType": "git"
            },
            {
              "lessThan": "5fedf279a1ea369d39c8b06dd4547cdc576065d0",
              "status": "affected",
              "version": "0a454bdd501ad1aa30bb72e9581efa338ad6ce5c",
              "versionType": "git"
            },
            {
              "lessThan": "e05c315b4da0c16ea800ee4b2cb6c617f586d1b5",
              "status": "affected",
              "version": "0a454bdd501ad1aa30bb72e9581efa338ad6ce5c",
              "versionType": "git"
            },
            {
              "lessThan": "fcce1b3be6d286aa80831e730289f4c062053ae6",
              "status": "affected",
              "version": "0a454bdd501ad1aa30bb72e9581efa338ad6ce5c",
              "versionType": "git"
            },
            {
              "lessThan": "a3bc6b3e9ef3f5f5cb85a902a30a090c7931127c",
              "status": "affected",
              "version": "0a454bdd501ad1aa30bb72e9581efa338ad6ce5c",
              "versionType": "git"
            },
            {
              "lessThan": "9e55fe24c548ad3163903eb58bb002d28d32a630",
              "status": "affected",
              "version": "0a454bdd501ad1aa30bb72e9581efa338ad6ce5c",
              "versionType": "git"
            },
            {
              "lessThan": "50958bb928bad3bdba9e5d1b7ff4bbadcf6951e6",
              "status": "affected",
              "version": "0a454bdd501ad1aa30bb72e9581efa338ad6ce5c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/caps.c",
            "fs/ceph/file.c",
            "fs/ceph/mds_client.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix hanging __ceph_get_caps() with stale mds_wanted\n\nA reader can hang forever in __ceph_get_caps() when the client no\nlonger holds `FILE_RD`, but local cap state still says that the\ncapability is already wanted (via `mds_wanted`).\n\nOne way to trigger this is through MDS cap revocation.  If another\nclient performs a conflicting operation, the MDS can revoke `FILE_RD`\nfrom the reader; the next read then has to reacquire `FILE_RD`.  If\nthe cap update that should request `FILE_RD` never reaches the MDS\nafter `cap-\u003emds_wanted` was raised, the reader is left holding only\nnon-file caps while local `mds_wanted` still includes the file read\ncaps.\n\nIn that state, try_get_cap_refs() sees `need \u003c= mds_wanted` and\nreturns 0, so __ceph_get_caps() just waits on `i_cap_wq`.  If the cap\nupdate that was supposed to request `FILE_RD never reaches the MDS\nafter `cap-\u003emds_wanted was` raised, no further request is sent and the\nwaiter can sleep indefinitely until unrelated cap traffic happens to\nwake it up.\n\nThe ordering issue is that `cap-\u003emds_wanted` is updated in\n__prep_cap() before the `CEPH_MSG_CLIENT_CAPS message` is actually\nqueued for send.  That makes one field serve two different meanings at\nonce: what this client wants, and what the client believes the MDS\nalready knows it wants.\n\nA proper fix would be to split those states and track whether a cap\nupdate is actually in flight or has been observed by the MDS.\nHowever, simply moving the `cap-\u003emds_wanted assignment` later would\nnot be sufficient: queueing the message in the messenger does not\nguarantee that the MDS processed that specific wanted set, and\nreconnect or message loss can still invalidate that assumption.\nFixing that properly would require a larger rework of the cap state\nmachine.\n\nTo allow simpler backports to stable kernels, this patch implements a\nsimpler workaround:\n\n- stop waiting forever in __ceph_get_caps(); after a bounded wait,\n  fall back to the renew path\n\n- make ceph_renew_caps() issue a synchronous `OPEN` request whenever\n  the inode still does not actually hold the wanted caps, instead of\n  only calling ceph_check_caps()\n\nThe extra issued-vs-wanted check in ceph_renew_caps() is necessary\nbecause the previous test only checked whether the inode still had any\nreal caps at all.  That is not enough after revocation: the client can\nstill hold something like `pLs` and yet be missing `FILE_RD`\ncompletely.  In that case, falling back to ceph_check_caps() is not\nsufficient, because it still trusts `cap-\u003emds_wanted` and may resend\nnothing.  By requiring `(issued \u0026 wanted) == wanted` before taking the\nasynchronous path, the code only uses ceph_check_caps() when the\n`wanted caps` are already actually issued.  Otherwise, it sends the\nsynchronous `OPEN` renew.\n\nThis preserves the existing asynchronous fast path when the wanted\ncaps are already issued, avoids changing cap-state semantics, and\nfixes the hang by guaranteeing that a stalled waiter eventually\nretries through a path that does not rely on the stale `mds_wanted`\nstate.\n\n[ idryomov: move CEPH_GET_CAPS_WAIT_TIMEOUT from libceph.h to\n  mds_client.h, formatting ]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - On nodes with cephfs mounted (common in Ceph/Rook/Kubernetes), a remote Ceph client can perform conflicting writes so the MDS revokes FILE_RD via CEPH_MSG_CLIENT_CAPS over the network; the victim kernel then hits the stale mds_wanted hang on the next VFS read/mmap/ioctl path into __ceph_get_caps().\nAC:L - The fix commit documents MDS cap revocation from another client as a reliable trigger; an attacker controls both sides by holding a second Ceph client session and driving conflicting I/O and reconnect/message-loss timing, without depending on uncontrollable victim heap layout or rare kernel configs.\nPR:N - Exploitation requires no Linux account, capability, or init-namespace root on the victim host; any remote (or co-tenant) Ceph client with write access to the shared file can induce revocation and the hang while victims only perform normal reads on an already-mounted cephfs export.\nUI:N - No interactive victim action is needed beyond routine automated reads on cephfs-backed workloads; the attacker does not require the victim to mount media, click a link, or perform a one-off administrative step at exploitation time.\nS:U - Impact is confined to threads blocked in __ceph_get_caps() on the same host kernel security domain; it does not cross VM, container, or IOMMU boundaries or grant elevated privileges beyond availability loss on the affected client.\nC:N - This is a capability wait-loop logic error with no out-of-bounds access, use-after-free, or information disclosure; stale mds_wanted only prevents cap reacquisition and does not read or leak kernel or file data to an attacker.\nI:N - The bug does not modify inode data, kernel memory, or capabilities; it causes indefinite sleeping in cap acquisition with no path to arbitrary write, metadata corruption, or code execution.\nA:H - Before the fix, __ceph_get_caps() could wait forever on i_cap_wq when mds_wanted falsely indicated FILE_RD was already requested but not issued, hanging the reader thread (read/write/mmap/getattr) until unrelated cap traffic; repeated exploitation can deny service to cephfs-backed applications."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T05:01:22.018Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b5661524c5a45085a866864ca9b8ae2513dfd67a"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e84bc6f67e19fdd192d8b215de728acbfc12572"
        },
        {
          "url": "https://git.kernel.org/stable/c/5fedf279a1ea369d39c8b06dd4547cdc576065d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/e05c315b4da0c16ea800ee4b2cb6c617f586d1b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/fcce1b3be6d286aa80831e730289f4c062053ae6"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3bc6b3e9ef3f5f5cb85a902a30a090c7931127c"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e55fe24c548ad3163903eb58bb002d28d32a630"
        },
        {
          "url": "https://git.kernel.org/stable/c/50958bb928bad3bdba9e5d1b7ff4bbadcf6951e6"
        }
      ],
      "title": "ceph: fix hanging __ceph_get_caps() with stale mds_wanted",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80527",
    "datePublished": "2026-08-26T14:37:06.178Z",
    "dateReserved": "2026-08-26T14:34:25.764Z",
    "dateUpdated": "2026-08-27T05:01:22.018Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80527",
      "date": "2026-09-17",
      "epss": "0.00508",
      "percentile": "0.42184"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-27T01:03:01.000Z",
      "cve": "CVE-2026-80527",
      "id": "msrc_CVE-2026-80527",
      "initial_release_date": "2026-08-27T01:03:01.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ceph: fix hanging __ceph_get_caps() with stale mds_wanted",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-80527.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80527\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-26T15:17:06.490\",\"lastModified\":\"2026-08-27T06:17:32.233\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nceph: fix hanging __ceph_get_caps() with stale mds_wanted\\n\\nA reader can hang forever in __ceph_get_caps() when the client no\\nlonger holds `FILE_RD`, but local cap state still says that the\\ncapability is already wanted (via `mds_wanted`).\\n\\nOne way to trigger this is through MDS cap revocation.  If another\\nclient performs a conflicting operation, the MDS can revoke `FILE_RD`\\nfrom the reader; the next read then has to reacquire `FILE_RD`.  If\\nthe cap update that should request `FILE_RD` never reaches the MDS\\nafter `cap-\u003emds_wanted` was raised, the reader is left holding only\\nnon-file caps while local `mds_wanted` still includes the file read\\ncaps.\\n\\nIn that state, try_get_cap_refs() sees `need \u003c= mds_wanted` and\\nreturns 0, so __ceph_get_caps() just waits on `i_cap_wq`.  If the cap\\nupdate that was supposed to request `FILE_RD never reaches the MDS\\nafter `cap-\u003emds_wanted was` raised, no further request is sent and the\\nwaiter can sleep indefinitely until unrelated cap traffic happens to\\nwake it up.\\n\\nThe ordering issue is that `cap-\u003emds_wanted` is updated in\\n__prep_cap() before the `CEPH_MSG_CLIENT_CAPS message` is actually\\nqueued for send.  That makes one field serve two different meanings at\\nonce: what this client wants, and what the client believes the MDS\\nalready knows it wants.\\n\\nA proper fix would be to split those states and track whether a cap\\nupdate is actually in flight or has been observed by the MDS.\\nHowever, simply moving the `cap-\u003emds_wanted assignment` later would\\nnot be sufficient: queueing the message in the messenger does not\\nguarantee that the MDS processed that specific wanted set, and\\nreconnect or message loss can still invalidate that assumption.\\nFixing that properly would require a larger rework of the cap state\\nmachine.\\n\\nTo allow simpler backports to stable kernels, this patch implements a\\nsimpler workaround:\\n\\n- stop waiting forever in __ceph_get_caps(); after a bounded wait,\\n  fall back to the renew path\\n\\n- make ceph_renew_caps() issue a synchronous `OPEN` request whenever\\n  the inode still does not actually hold the wanted caps, instead of\\n  only calling ceph_check_caps()\\n\\nThe extra issued-vs-wanted check in ceph_renew_caps() is necessary\\nbecause the previous test only checked whether the inode still had any\\nreal caps at all.  That is not enough after revocation: the client can\\nstill hold something like `pLs` and yet be missing `FILE_RD`\\ncompletely.  In that case, falling back to ceph_check_caps() is not\\nsufficient, because it still trusts `cap-\u003emds_wanted` and may resend\\nnothing.  By requiring `(issued \u0026 wanted) == wanted` before taking the\\nasynchronous path, the code only uses ceph_check_caps() when the\\n`wanted caps` are already actually issued.  Otherwise, it sends the\\nsynchronous `OPEN` renew.\\n\\nThis preserves the existing asynchronous fast path when the wanted\\ncaps are already issued, avoids changing cap-state semantics, and\\nfixes the hang by guaranteeing that a stalled waiter eventually\\nretries through a path that does not rely on the stale `mds_wanted`\\nstate.\\n\\n[ idryomov: move CEPH_GET_CAPS_WAIT_TIMEOUT from libceph.h to\\n  mds_client.h, formatting ]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ceph/caps.c\",\"fs/ceph/file.c\",\"fs/ceph/mds_client.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0a454bdd501ad1aa30bb72e9581efa338ad6ce5c\",\"lessThan\":\"b5661524c5a45085a866864ca9b8ae2513dfd67a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0a454bdd501ad1aa30bb72e9581efa338ad6ce5c\",\"lessThan\":\"5e84bc6f67e19fdd192d8b215de728acbfc12572\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0a454bdd501ad1aa30bb72e9581efa338ad6ce5c\",\"lessThan\":\"5fedf279a1ea369d39c8b06dd4547cdc576065d0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0a454bdd501ad1aa30bb72e9581efa338ad6ce5c\",\"lessThan\":\"e05c315b4da0c16ea800ee4b2cb6c617f586d1b5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0a454bdd501ad1aa30bb72e9581efa338ad6ce5c\",\"lessThan\":\"fcce1b3be6d286aa80831e730289f4c062053ae6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0a454bdd501ad1aa30bb72e9581efa338ad6ce5c\",\"lessThan\":\"a3bc6b3e9ef3f5f5cb85a902a30a090c7931127c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0a454bdd501ad1aa30bb72e9581efa338ad6ce5c\",\"lessThan\":\"9e55fe24c548ad3163903eb58bb002d28d32a630\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0a454bdd501ad1aa30bb72e9581efa338ad6ce5c\",\"lessThan\":\"50958bb928bad3bdba9e5d1b7ff4bbadcf6951e6\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ceph/caps.c\",\"fs/ceph/file.c\",\"fs/ceph/mds_client.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.266\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.217\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.184\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.153\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.105\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.46\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.10\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/50958bb928bad3bdba9e5d1b7ff4bbadcf6951e6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5e84bc6f67e19fdd192d8b215de728acbfc12572\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5fedf279a1ea369d39c8b06dd4547cdc576065d0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9e55fe24c548ad3163903eb58bb002d28d32a630\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a3bc6b3e9ef3f5f5cb85a902a30a090c7931127c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b5661524c5a45085a866864ca9b8ae2513dfd67a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e05c315b4da0c16ea800ee4b2cb6c617f586d1b5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fcce1b3be6d286aa80831e730289f4c062053ae6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-27T08:25:41+00:00",
      "cve": "CVE-2026-80527",
      "id": "CVE-2026-80527",
      "initial_release_date": "2026-08-26T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ceph: fix hanging __ceph_get_caps() with stale mds_wanted",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80527.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:12:08Z",
      "cve": "CVE-2026-80527",
      "id": "CVE-2026-80527",
      "initial_release_date": "2026-08-27T00:12:37Z",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "93",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80527",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80527.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.