External risk intelligence

Linux Kernel Ceph Filename Decryption Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-90042

This vulnerability exists within the Linux kernel's Ceph filesystem client, specifically involving internal memory management during filename decryption. It is a low-level kernel component issue that is not a public-facing service, API, or network-accessible application, making it highly unlikely to be directly reachable from the public internet in common deployments.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Linux kernel's Ceph filesystem client has been resolved, addressing how filenames are decrypted in memory buffers. This issue could lead to system instability, particularly on non-x86 platforms, by causing unexpected program terminations. The fix ensures that memory buffers are handled correctly to prevent these issues.

Kernel issue with memory handling resolved.
Affects internal Ceph filesystem operations.
Confirm relevance and scope of exposure.

Attack Path

How an attacker could exploit the issue

An attacker could trigger this vulnerability by sending specially crafted messages to the Ceph filesystem client. If these messages are located in certain memory regions allocated by `kvmalloc()`, the system may crash or exhibit other undesirable behavior.

Vulnerability triggered by specific message content.
Affects internal filename decryption process.
Potential for system instability or crashes.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect how filenames are decrypted within Linux kernel buffers, potentially leading to system instability or unexpected behavior, especially on non-x86 platforms. The issue arises when filename data is handled in memory regions that are not linearly mapped, which can occur due to memory fragmentation.

System stability and filename decryption.
Inaccessible memory buffers cause kernel errors.
System crashes or unexpected behavior.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects the Linux kernel's Ceph filesystem client, specifically its handling of encrypted filenames within `vmalloc()` buffers. Infrastructure or platform teams managing Ceph deployments should initiate an investigation to locate all instances of the affected kernel component. Subsequently, these teams, in coordination with security and vendor management, must assess the exposure and criticality of these instances to prioritize remediation efforts, which may involve vendor engagement or kernel updates.

Kernel and Ceph owners should address.
Verify affected kernel instances' reachability.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel Ceph filesystem client?

It is a component within the Linux operating system that allows computers to mount and interact with Ceph storage clusters. Ceph provides distributed data storage, and the kernel client handles the low-level tasks, such as communicating with storage nodes and managing encrypted filename data, required for the operating system to read and write files on these network drives.

How does CVE-2026-90042 impact memory handling?

This vulnerability involves an improper memory access issue. The crypto libraries used for decrypting filenames expect data to be in a specific, linearly mapped memory region. However, the Ceph client sometimes stores this data in fragmented memory buffers. This mismatch causes the kernel to attempt invalid memory operations when it tries to decrypt filenames, leading to system errors.

Do I need a specially crafted message to trigger this bug?

Yes, an attacker must send specific, malicious messages to the Ceph client. However, this only triggers a kernel crash if the message data happens to be placed into a non-linear memory region by the system's memory allocator. Messages successfully stored in linearly mapped memory do not trigger this specific decryption flaw.

Why is this considered unlikely to be reachable from the internet?

Halo Surface Signal indicates that this issue resides deep within the kernel's internal filesystem processing logic. Because it involves low-level memory management for storage mounts rather than a direct network-facing service, it is not an application or API that users typically expose directly to the public internet.

How should I prioritize a response for CVE-2026-90042?

First, identify systems in your environment that utilize the Ceph filesystem client. Since the vulnerability requires specific memory conditions and targets internal kernel operations, prioritize updates for systems where Ceph availability is mission-critical. Coordinate with your platform teams to plan kernel patches or vendor-provided updates to resolve the memory buffer handling logic.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.