Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-90042: Linux kernel Ceph may crash when decrypting filenames
CVE-2026-90042 · published 1 month ago
Summary
The Ceph file system in the Linux kernel could crash when it tries to decode encrypted file names stored in certain memory buffers. This mainly affects Linux distributions that include the kernel, such as Debian and Ubuntu. Updating the kernel to the latest version resolves the issue.
What to do
- Update debian linux to version 7.2.6-1.
- Update linux kernel to version 7.2.5.
- Update bellsoft linux-lts to version 6.18.53-r0.
- Update debian linux to version 6.12.111-1.
- Update bellsoft linux-lts to version 6.12.111-r0.
- Update debian linux-6.12 to version 6.12.111-1~deb12u1.
- Update canonical linux-hwe-7.0 to version 7.0.0-42.42~24.04.1.
- Update canonical linux-riscv-7.0 to version 7.0.0-42.42.1~24.04.1.
- Update canonical linux to version 7.0.0-42.42.
- Update canonical linux-aws to version 7.0.0-1016.17.
- Update canonical linux-gcp to version 7.0.0-1016.18.
- Update canonical linux-ibm to version 7.0.0-1017.17.
- Update canonical linux-oem-7.0 to version 7.0.0-1017.17.
- Update canonical linux-oracle to version 7.0.0-1015.16.
- Update canonical linux-riscv to version 7.0.0-42.42.1.
- Update canonical linux-nvidia-tegra to version 6.8.0-1038.42.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:13 | debian | linux |
< 6.12.111-1 Fix: upgrade to 6.12.111-1
|
| Debian:14 | debian | linux |
< 7.2.6-1 Fix: upgrade to 7.2.6-1
|
| – | linux | linux |
< 110747ff535e3d98ac17d68dbd056bb6ef000e23 6.6 < 93729594af506557a86f8b603be7ac5f3370eeca |
| Linux | linux | kernel |
>= 6.19.0, < 7.2.5 Fix: upgrade to 7.2.5
|
| Ubuntu:Pro:14.04:LTS | canonical | linux | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | linux-aws | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | linux-lts-xenial | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | linux-aws-hwe | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | linux-gcp | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | linux-hwe | All versions |
| Ubuntu:16.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | linux-kvm | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | linux-oracle | All versions |
| Ubuntu:Pro:FIPS:16.04:LTS | canonical | linux-fips | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.3 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-aws-5.4 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-azure-4.15 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-5.3 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-azure-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-edge | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-gcp-4.15 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp-5.3 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-gcp-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-4.15 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gkeop-5.4 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-hwe-5.4 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-ibm-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oem | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.3 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-oracle-5.4 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-raspi-5.4 | All versions |
| Ubuntu:Pro:FIPS-updates:18.04:LTS | canonical | linux-aws-fips | All versions |
| Ubuntu:Pro:FIPS-updates:18.04:LTS | canonical | linux-azure-fips | All versions |
| Ubuntu:Pro:FIPS-updates:18.04:LTS | canonical | linux-gcp-fips | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-aws-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-azure-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-fde | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-azure-fde-5.15 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-bluefield | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.11 | All versions |
Showing 50 of 183. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-gcp-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-hwe-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.8 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-ibm | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-ibm-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-intel-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-intel-iotg-5.15 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-iot | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-lowlatency-hwe-5.15 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-nvidia-tegra-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.10 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.14 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.6 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-oracle-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.8 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-raspi | All versions |
| Ubuntu:20.04:LTS | canonical | linux-raspi2 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.11 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-riscv-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.8 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-xilinx-zynqmp | All versions |
| Ubuntu:22.04:LTS | canonical | linux-allwinner-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-6.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-ibm-6.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-intel-iot-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-intel-iotg | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-tegra | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-tegra-igx | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-5.17 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.0 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.1 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oracle-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oracle-6.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-6.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-6.5 | All versions |
| Ubuntu:Pro:Realtime:22.04:LTS | canonical | linux-realtime-6.8 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-aws-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-aws-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-aws-7.0 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-7.0 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-fde-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-fde-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-fde-7.0 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-nvidia | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-nvidia-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-gcp-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-gcp-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-gcp-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-gcp-7.0 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-hwe-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-hwe-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-hwe-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-hwe-7.0 |
< 7.0.0-42.42~24.04.1 Fix: upgrade to 7.0.0-42.42~24.04.1
|
| Ubuntu:24.04:LTS | canonical | linux-lowlatency-hwe-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-nvidia-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-nvidia-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-nvidia-7.0 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-nvidia-lowlatency | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oem-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oem-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oem-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oem-6.8 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oracle-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oracle-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oracle-7.0 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-raspi-realtime | All versions |
| Ubuntu:24.04:LTS | canonical | linux-riscv-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-riscv-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-riscv-7.0 |
< 7.0.0-42.42.1~24.04.1 Fix: upgrade to 7.0.0-42.42.1~24.04.1
|
| Ubuntu:24.04:LTS | canonical | linux-xilinx | All versions |
| Ubuntu:Pro:Realtime:24.04:LTS | canonical | linux-realtime-6.14 | All versions |
| Ubuntu:Pro:Realtime:24.04:LTS | canonical | linux-realtime-6.17 | All versions |
| Ubuntu:26.04:LTS | canonical | linux-nvidia-bos | All versions |
| Ubuntu:26.04:LTS | canonical | linux-oem-7.0 |
< 7.0.0-1017.17 Fix: upgrade to 7.0.0-1017.17
|
| Alpaquita:25 | bellsoft | linux-lts |
>= 6.12.103-r0 >= 6.12.103-r0, < 6.12.111-r0 Fix: upgrade to 6.12.111-r0
|
| Alpaquita:stream | bellsoft | linux-lts |
>= 6.18.46-r0 >= 6.18.46-r0, < 6.18.53-r0 Fix: upgrade to 6.18.53-r0
|
| Debian:12 | debian | linux-6.12 |
< 6.12.111-1~deb12u1 Fix: upgrade to 6.12.111-1~deb12u1
|
| Ubuntu:24.04:LTS | canonical | linux-vmware | All versions |
| Ubuntu:26.04:LTS | canonical | linux |
< 7.0.0-42.42 Fix: upgrade to 7.0.0-42.42
|
| Ubuntu:26.04:LTS | canonical | linux-aws |
< 7.0.0-1016.17 Fix: upgrade to 7.0.0-1016.17
|
| Ubuntu:26.04:LTS | canonical | linux-gcp |
< 7.0.0-1016.18 Fix: upgrade to 7.0.0-1016.18
|
| Ubuntu:26.04:LTS | canonical | linux-ibm |
< 7.0.0-1017.17 Fix: upgrade to 7.0.0-1017.17
|
| Ubuntu:26.04:LTS | canonical | linux-oracle |
< 7.0.0-1015.16 Fix: upgrade to 7.0.0-1015.16
|
| Ubuntu:26.04:LTS | canonical | linux-riscv |
< 7.0.0-42.42.1 Fix: upgrade to 7.0.0-42.42.1
|
| Ubuntu:24.04:LTS | canonical | linux-nvidia-tegra |
< 6.8.0-1038.42 Fix: upgrade to 6.8.0-1038.42
|
Original advisory text
ceph: properly decrypt filenames in vmalloc() buffers
In the Linux kernel, the following vulnerability has been resolved: ceph: properly decrypt filenames in vmalloc() buffers The fscrypt subsystem uses the scatterlist crypto API, inheriting its requirement that any buffers are in the linear mapping region. However, the messenger client uses kvmalloc() to create buffers for messages, which will occasionally place those buffers in the vmalloc() region when physical memory fragmentation doesn't permit a large enough kmalloc(). The various callers of ceph_fname_to_usr() directly pass (slices of) raw messages from the MDS without considering that the messages may be in vmalloc() buffers, resulting in oopses especially on non-x86 platforms (see 'Closes:' for more details and a reproducer). Make ceph_fname_to_usr() explicitly tolerant of vmalloc()-allocated fname->ctext, fname->name, and/or oname->name buffers, using `tname` (which, when non-null, must be a linear address; when null, is briefly allocated as necessary) as a bounce buffer to avoid passing any inappropriate addresses to fscrypt_fname_disk_to_usr(). Additionally change parse_reply_info_readdir() -- the only function to supply its own `tname` -- to follow the new "tname must never come from vmalloc()" rule by passing NULL when the message is not in the linear region. Though this causes a per-dentry kmalloc()+kfree(), this overhead exists only when processing the minority of messages that spill into vmalloc(). My (crude) testing puts this at only about 1 in 8,000 readdir messages. Still, if the overhead proves unreasonable in the future, it is easy enough to mitigate: a future change could allocate a bounce buffer in parse_reply_info_readdir() and use that as `tname` instead.
References
- https://git.kernel.org/stable/c/e939fc6a7bd969a58a150b7f188c1047138403e3 URL
- https://security-tracker.debian.org/tracker/CVE-2026-90042 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-90042 Third Party Advisory
- https://docs.bell-sw.com/security/cves/CVE-2026-90042 Vendor Advisory
- https://git.kernel.org/stable/c/110747ff535e3d98ac17d68dbd056bb6ef000e23 URL
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
- https://git.kernel.org/stable/c/23c5cc9652c6ee85617002cb66e1068395045de6 URL
- https://git.kernel.org/stable/c/3b467c68803d7c7e82678289e598afd44faa6101 URL
- https://git.kernel.org/stable/c/93729594af506557a86f8b603be7ac5f3370eeca URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90042... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-90042 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-90042 Third Party Advisory
- https://git.kernel.org/linus/e939fc6a7bd969a58a150b7f188c1047138403e3 Third Party Advisory
- https://ubuntu.com/security/notices/USN-8959-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8960-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-9002-1 Vendor Advisory
Severity
9.8
Critical
Timeline
Published16 Sep 2026
Updated12 Nov 2026
First seen16 Sep 2026
Sources
CVE-2026-90042 · NVD
CVE-2026-90042 · MITRE
CVE-2026-90042 · OSV
DEBIAN-CVE-2026-90042 · OSV
UBUNTU-CVE-2026-90042 · OSV
BELL-CVE-2026-90042 · OSV
Track software like this
Free during beta