GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89647 (GCVE-0-2026-89647)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:45 – Updated: 2026-09-13 06:32
VLAI
Title
ceph: do not repeat ceph_trim_dentries() if no progress possible
Summary
In the Linux kernel, the following vulnerability has been resolved: ceph: do not repeat ceph_trim_dentries() if no progress possible ceph_cap_reclaim_work() re-queues itself for as long as ceph_trim_dentries() returns -EAGAIN, which happens whenever a lease walk exhausts its `nr_to_scan` budget. This creates a busy loop that consumes CPU without making any progress when there is nothing to reclaim: with no cap pressure (`count==0`) and every scanned lease still valid, each pass runs the full scan budget down to zero and returns `-EAGAIN`, only to be queued again immediately. The dir-lease walk made this worse. When `expire_dir_lease` is `false` (i.e. we have no intention of reclaiming dir leases), __dir_lease_check() returned `TOUCH` for every valid lease. `TOUCH` moves the dentry to the tail of the list and resets `di->time` via __dentry_dir_lease_touch(), so a walk over N valid leases pointlessly rewrote the list, refreshed the timestamps (preventing them from ever aging out) and always drained `nr_to_scan`, guaranteeing the `-EAGAIN` requeue. Fix this in three steps: - Return `KEEP` instead of `TOUCH` when `expire_dir_lease` is `false`. If we are not going to reclaim the lease, leave it in place instead of churning the list and resetting its timestamp; the walk then terminates naturally (or via `STOP` at the first fresh lease). - Only return `-EAGAIN` from the first (dentry-lease) walk when something was actually freed. A full batch that frees nothing means retrying the same list immediately is futile; fall through to the dir-lease walk instead. - After both walks, bail out with success (0) when nothing was freed and there is no cap pressure (`count==0`). There is no reason to keep retrying when we are not over the cap limit and made no progress. Under real cap pressure (`count>0`) the reclaim path is unchanged and still retries via `-EAGAIN`. Without this patch, I saw 500 ceph_trim_dentries() calls per second on our web servers. This is very visible in `/proc/lock_stat` (5 minute capture): class name con-bounces contentions waittime-min waittime-max waittime-total waittime-avg acq-bounces acquisitions holdtime-min holdtime-max holdtime-total holdtime-avg &mdsc->dentry_list_lock: 126180 128218 0.04 8063.44 15986965.20 124.69 1573354 5296812 0.04 8291.28 74164526.48 14.00 ----------------------- &mdsc->dentry_list_lock 111736 [<000000007b11e319>] __ceph_dentry_dir_lease_touch+0x7c/0xa8 &mdsc->dentry_list_lock 2631 [<0000000050597999>] __dentry_leases_walk+0x64/0x2c8 &mdsc->dentry_list_lock 3878 [<00000000c0022f62>] __ceph_dentry_lease_touch+0x5c/0xa8 &mdsc->dentry_list_lock 9973 [<000000002f27cb6f>] __dentry_lease_unlist+0x50/0xa0 ----------------------- &mdsc->dentry_list_lock 123621 [<0000000050597999>] __dentry_leases_walk+0x64/0x2c8 &mdsc->dentry_list_lock 1822 [<000000007b11e319>] __ceph_dentry_dir_lease_touch+0x7c/0xa8 &mdsc->dentry_list_lock 2720 [<000000002f27cb6f>] __dentry_lease_unlist+0x50/0xa0 &mdsc->dentry_list_lock 55 [<00000000c0022f62>] __ceph_dentry_lease_touch+0x5c/0xa8 With this patch: class name con-bounces contentions waittime-min waittime-max waittime-total waittime-avg acq-bounces acquisitions holdtime-min holdtime-max holdtime-total holdtime-avg &mdsc->dentry_list_lock: 1203 1215 0.16 408.88 33082.88 27.23 4320501 7357389 0.04 500.64 1961578.00 0.27 ----------------------- &mdsc->dentry_list_lock 1029 [<000000003c9aea8a>] __ceph_dentry_dir_lease_touch+0x7c/0xa8 &mdsc->dentry_list_lock 1 ---truncated---
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 37c4efc1ddf98ba8b234d116d863a9464445901e , < 5a541eb401acb89d791da41189d7a79220164b93 (git)
Affected: 37c4efc1ddf98ba8b234d116d863a9464445901e , < 37d6edb2f03b29399a3a337fae78674de51e1695 (git)
Affected: 37c4efc1ddf98ba8b234d116d863a9464445901e , < 3d122b2feb1dd76bb5041bdea5e1e1b007d8d415 (git)
Affected: 37c4efc1ddf98ba8b234d116d863a9464445901e , < e7d7aa7b730178278109c41fa1b17b06873065d5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.1
Unaffected: 0 , < 5.1 (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5a541eb401acb89d791da41189d7a79220164b93",
              "status": "affected",
              "version": "37c4efc1ddf98ba8b234d116d863a9464445901e",
              "versionType": "git"
            },
            {
              "lessThan": "37d6edb2f03b29399a3a337fae78674de51e1695",
              "status": "affected",
              "version": "37c4efc1ddf98ba8b234d116d863a9464445901e",
              "versionType": "git"
            },
            {
              "lessThan": "3d122b2feb1dd76bb5041bdea5e1e1b007d8d415",
              "status": "affected",
              "version": "37c4efc1ddf98ba8b234d116d863a9464445901e",
              "versionType": "git"
            },
            {
              "lessThan": "e7d7aa7b730178278109c41fa1b17b06873065d5",
              "status": "affected",
              "version": "37c4efc1ddf98ba8b234d116d863a9464445901e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "lessThan": "5.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: do not repeat ceph_trim_dentries() if no progress possible\n\nceph_cap_reclaim_work() re-queues itself for as long as\nceph_trim_dentries() returns -EAGAIN, which happens whenever a lease\nwalk exhausts its `nr_to_scan` budget.  This creates a busy loop that\nconsumes CPU without making any progress when there is nothing to\nreclaim: with no cap pressure (`count==0`) and every scanned lease\nstill valid, each pass runs the full scan budget down to zero and\nreturns `-EAGAIN`, only to be queued again immediately.\n\nThe dir-lease walk made this worse.  When `expire_dir_lease` is\n`false` (i.e. we have no intention of reclaiming dir leases),\n__dir_lease_check() returned `TOUCH` for every valid lease.  `TOUCH`\nmoves the dentry to the tail of the list and resets `di-\u003etime` via\n__dentry_dir_lease_touch(), so a walk over N valid leases pointlessly\nrewrote the list, refreshed the timestamps (preventing them from ever\naging out) and always drained `nr_to_scan`, guaranteeing the `-EAGAIN`\nrequeue.\n\nFix this in three steps:\n\n - Return `KEEP` instead of `TOUCH` when `expire_dir_lease` is\n   `false`.  If we are not going to reclaim the lease, leave it in\n   place instead of churning the list and resetting its timestamp; the\n   walk then terminates naturally (or via `STOP` at the first fresh\n   lease).\n\n - Only return `-EAGAIN` from the first (dentry-lease) walk when something\n   was actually freed.  A full batch that frees nothing means retrying\n   the same list immediately is futile; fall through to the dir-lease\n   walk instead.\n\n - After both walks, bail out with success (0) when nothing was freed\n   and there is no cap pressure (`count==0`).  There is no reason to\n   keep retrying when we are not over the cap limit and made no\n   progress.\n\nUnder real cap pressure (`count\u003e0`) the reclaim path is unchanged and\nstill retries via `-EAGAIN`.\n\nWithout this patch, I saw 500 ceph_trim_dentries() calls per second on\nour web servers.  This is very visible in `/proc/lock_stat` (5 minute\ncapture):\n\n              class name    con-bounces    contentions   waittime-min   waittime-max waittime-total   waittime-avg    acq-bounces   acquisitions   holdtime-min   holdtime-max holdtime-total   holdtime-avg\n\n \u0026mdsc-\u003edentry_list_lock:        126180         128218           0.04        8063.44    15986965.20         124.69        1573354        5296812           0.04        8291.28    74164526.48          14.00\n -----------------------\n \u0026mdsc-\u003edentry_list_lock         111736          [\u003c000000007b11e319\u003e] __ceph_dentry_dir_lease_touch+0x7c/0xa8\n \u0026mdsc-\u003edentry_list_lock           2631          [\u003c0000000050597999\u003e] __dentry_leases_walk+0x64/0x2c8\n \u0026mdsc-\u003edentry_list_lock           3878          [\u003c00000000c0022f62\u003e] __ceph_dentry_lease_touch+0x5c/0xa8\n \u0026mdsc-\u003edentry_list_lock           9973          [\u003c000000002f27cb6f\u003e] __dentry_lease_unlist+0x50/0xa0\n -----------------------\n \u0026mdsc-\u003edentry_list_lock         123621          [\u003c0000000050597999\u003e] __dentry_leases_walk+0x64/0x2c8\n \u0026mdsc-\u003edentry_list_lock           1822          [\u003c000000007b11e319\u003e] __ceph_dentry_dir_lease_touch+0x7c/0xa8\n \u0026mdsc-\u003edentry_list_lock           2720          [\u003c000000002f27cb6f\u003e] __dentry_lease_unlist+0x50/0xa0\n \u0026mdsc-\u003edentry_list_lock             55          [\u003c00000000c0022f62\u003e] __ceph_dentry_lease_touch+0x5c/0xa8\n\nWith this patch:\n\n              class name    con-bounces    contentions   waittime-min   waittime-max waittime-total   waittime-avg    acq-bounces   acquisitions   holdtime-min   holdtime-max holdtime-total   holdtime-avg\n\n \u0026mdsc-\u003edentry_list_lock:          1203           1215           0.16         408.88       33082.88          27.23        4320501        7357389           0.04         500.64     1961578.00           0.27\n -----------------------\n \u0026mdsc-\u003edentry_list_lock           1029          [\u003c000000003c9aea8a\u003e] __ceph_dentry_dir_lease_touch+0x7c/0xa8\n \u0026mdsc-\u003edentry_list_lock            1\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - fs/ceph registers ceph_export_ops, so remote nfsd/ksmbd readdir and lookup on an exported CephFS mount populate dentry and dir-lease lists and drive ceph_trim_dentries() via the cap-reclaim workqueue; a compromised MDS on the existing client TCP session can also keep those leases valid.\nAC:L - Default caps_max leaves count==0, so expire_dir_lease is false and valid dir leases are TOUCHed until nr_to_scan hits zero; ceph_cap_reclaim_work() then immediately requeues on -EAGAIN. An attacker who walks or creates many dentries, or a peer that grants many still-valid leases, triggers this deterministically with no race.\nPR:N - In the network-export scenario the attacker needs no local account or capability on the victim host; guest or anonymous NFS/SMB exports of CephFS, and a remote MDS peer on an already-connected kernel client, are reasonable high-severity deployments matching other Ceph client CVEs.\nUI:N - After CephFS is mounted and optionally exported, delayed_work periodically queues reclaim and the attacker\u2019s own readdir/lookup or MDS lease traffic is enough; no separate victim mount, open, or confirmation is required at exploit time.\nS:U - The busy loop, CPU burn, and dentry_list_lock contention stay inside the host kernel CephFS client and do not cross a VM, IOMMU, or sandbox boundary to another security authority.\nC:N - The defect only rescans and TOUCHes still-valid dentry leases; it does not perform an out-of-bounds read, use-after-free, or any other kernel-memory disclosure.\nI:N - The walk only reshuffles lease-list order and refreshes dentry timestamps; there is no memory corruption, arbitrary write, or control-flow hijack primitive.\nA:H - ceph_cap_reclaim_work() immediately requeues itself on -EAGAIN, forming an unbounded busy loop on the max_active=1 ceph-cap workqueue (observed ~500 iterations/s) that starves cap-release work, burns CPU, and contends dentry_list_lock enough to stall Ceph directory operations."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:32:25.355Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5a541eb401acb89d791da41189d7a79220164b93"
        },
        {
          "url": "https://git.kernel.org/stable/c/37d6edb2f03b29399a3a337fae78674de51e1695"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d122b2feb1dd76bb5041bdea5e1e1b007d8d415"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7d7aa7b730178278109c41fa1b17b06873065d5"
        }
      ],
      "title": "ceph: do not repeat ceph_trim_dentries() if no progress possible",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89647",
    "datePublished": "2026-09-11T19:45:38.593Z",
    "dateReserved": "2026-09-11T19:38:34.741Z",
    "dateUpdated": "2026-09-13T06:32:25.355Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89647",
      "date": "2026-09-16",
      "epss": "0.0063",
      "percentile": "0.4852"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-14T14:55:49.000Z",
      "cve": "CVE-2026-89647",
      "id": "msrc_CVE-2026-89647",
      "initial_release_date": "2026-09-13T01:08:57.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ceph: do not repeat ceph_trim_dentries() if no progress possible",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89647.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89647\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:50.607\",\"lastModified\":\"2026-09-13T07:17:29.837\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nceph: do not repeat ceph_trim_dentries() if no progress possible\\n\\nceph_cap_reclaim_work() re-queues itself for as long as\\nceph_trim_dentries() returns -EAGAIN, which happens whenever a lease\\nwalk exhausts its `nr_to_scan` budget.  This creates a busy loop that\\nconsumes CPU without making any progress when there is nothing to\\nreclaim: with no cap pressure (`count==0`) and every scanned lease\\nstill valid, each pass runs the full scan budget down to zero and\\nreturns `-EAGAIN`, only to be queued again immediately.\\n\\nThe dir-lease walk made this worse.  When `expire_dir_lease` is\\n`false` (i.e. we have no intention of reclaiming dir leases),\\n__dir_lease_check() returned `TOUCH` for every valid lease.  `TOUCH`\\nmoves the dentry to the tail of the list and resets `di-\u003etime` via\\n__dentry_dir_lease_touch(), so a walk over N valid leases pointlessly\\nrewrote the list, refreshed the timestamps (preventing them from ever\\naging out) and always drained `nr_to_scan`, guaranteeing the `-EAGAIN`\\nrequeue.\\n\\nFix this in three steps:\\n\\n - Return `KEEP` instead of `TOUCH` when `expire_dir_lease` is\\n   `false`.  If we are not going to reclaim the lease, leave it in\\n   place instead of churning the list and resetting its timestamp; the\\n   walk then terminates naturally (or via `STOP` at the first fresh\\n   lease).\\n\\n - Only return `-EAGAIN` from the first (dentry-lease) walk when something\\n   was actually freed.  A full batch that frees nothing means retrying\\n   the same list immediately is futile; fall through to the dir-lease\\n   walk instead.\\n\\n - After both walks, bail out with success (0) when nothing was freed\\n   and there is no cap pressure (`count==0`).  There is no reason to\\n   keep retrying when we are not over the cap limit and made no\\n   progress.\\n\\nUnder real cap pressure (`count\u003e0`) the reclaim path is unchanged and\\nstill retries via `-EAGAIN`.\\n\\nWithout this patch, I saw 500 ceph_trim_dentries() calls per second on\\nour web servers.  This is very visible in `/proc/lock_stat` (5 minute\\ncapture):\\n\\n              class name    con-bounces    contentions   waittime-min   waittime-max waittime-total   waittime-avg    acq-bounces   acquisitions   holdtime-min   holdtime-max holdtime-total   holdtime-avg\\n\\n \u0026mdsc-\u003edentry_list_lock:        126180         128218           0.04        8063.44    15986965.20         124.69        1573354        5296812           0.04        8291.28    74164526.48          14.00\\n -----------------------\\n \u0026mdsc-\u003edentry_list_lock         111736          [\u003c000000007b11e319\u003e] __ceph_dentry_dir_lease_touch+0x7c/0xa8\\n \u0026mdsc-\u003edentry_list_lock           2631          [\u003c0000000050597999\u003e] __dentry_leases_walk+0x64/0x2c8\\n \u0026mdsc-\u003edentry_list_lock           3878          [\u003c00000000c0022f62\u003e] __ceph_dentry_lease_touch+0x5c/0xa8\\n \u0026mdsc-\u003edentry_list_lock           9973          [\u003c000000002f27cb6f\u003e] __dentry_lease_unlist+0x50/0xa0\\n -----------------------\\n \u0026mdsc-\u003edentry_list_lock         123621          [\u003c0000000050597999\u003e] __dentry_leases_walk+0x64/0x2c8\\n \u0026mdsc-\u003edentry_list_lock           1822          [\u003c000000007b11e319\u003e] __ceph_dentry_dir_lease_touch+0x7c/0xa8\\n \u0026mdsc-\u003edentry_list_lock           2720          [\u003c000000002f27cb6f\u003e] __dentry_lease_unlist+0x50/0xa0\\n \u0026mdsc-\u003edentry_list_lock             55          [\u003c00000000c0022f62\u003e] __ceph_dentry_lease_touch+0x5c/0xa8\\n\\nWith this patch:\\n\\n              class name    con-bounces    contentions   waittime-min   waittime-max waittime-total   waittime-avg    acq-bounces   acquisitions   holdtime-min   holdtime-max holdtime-total   holdtime-avg\\n\\n \u0026mdsc-\u003edentry_list_lock:          1203           1215           0.16         408.88       33082.88          27.23        4320501        7357389           0.04         500.64     1961578.00           0.27\\n -----------------------\\n \u0026mdsc-\u003edentry_list_lock           1029          [\u003c000000003c9aea8a\u003e] __ceph_dentry_dir_lease_touch+0x7c/0xa8\\n \u0026mdsc-\u003edentry_list_lock            1\\n---truncated---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ceph/dir.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"37c4efc1ddf98ba8b234d116d863a9464445901e\",\"lessThan\":\"5a541eb401acb89d791da41189d7a79220164b93\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"37c4efc1ddf98ba8b234d116d863a9464445901e\",\"lessThan\":\"37d6edb2f03b29399a3a337fae78674de51e1695\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"37c4efc1ddf98ba8b234d116d863a9464445901e\",\"lessThan\":\"3d122b2feb1dd76bb5041bdea5e1e1b007d8d415\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"37c4efc1ddf98ba8b234d116d863a9464445901e\",\"lessThan\":\"e7d7aa7b730178278109c41fa1b17b06873065d5\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ceph/dir.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/37d6edb2f03b29399a3a337fae78674de51e1695\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3d122b2feb1dd76bb5041bdea5e1e1b007d8d415\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5a541eb401acb89d791da41189d7a79220164b93\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e7d7aa7b730178278109c41fa1b17b06873065d5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T06:59:53+00:00",
      "cve": "CVE-2026-89647",
      "id": "CVE-2026-89647",
      "initial_release_date": "2026-09-11T19:45:38.593000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ceph: Linux kernel Ceph: Excessive CPU utilization due to busy loop in dentry trimming",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89647.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:01:14Z",
      "cve": "CVE-2026-89647",
      "id": "CVE-2026-89647",
      "initial_release_date": "2026-09-12T16:24:17Z",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "93",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89647",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89647.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.