{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-89647 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-89647 is a high-severity denial of service vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-89647 and fix it if it is affected.\n\nWhat it is: CVE-2026-89647 is a high-severity denial of service vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-89647 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-89647/ (Markdown: https://insights.sbomify.com/CVE-2026-89647/index.md)","id":"CVE-2026-89647","markdown":"https://insights.sbomify.com/CVE-2026-89647/index.md","name":"CVE-2026-89647","record":{"aliases":["AZL-100238","BELL-CVE-2026-89647","DEBIAN-CVE-2026-89647","GHSA-m843-78wr-m386","UBUNTU-CVE-2026-89647"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Linux kernel Ceph client","requires_auth":"none","summary":"A logic error in the Linux kernel's Ceph client causes a busy loop consuming CPU when no dentries can be reclaimed, leading to denial of service.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nceph: do not repeat ceph_trim_dentries() if no progress possible\n\nceph_cap_reclaim_work() re-queues itself for as long as\nceph_trim_dentries() returns -EAGAIN, which happens whenever a lease\nwalk exhausts its `nr_to_scan` budget.  This creates a busy loop that\nconsumes CPU without making any progress when there is nothing to\nreclaim: with no cap pressure (`count==0`) and every scanned lease\nstill valid, each pass runs the full scan budget down to zero and\nreturns `-EAGAIN`, only to be queued again immediately.\n\nThe dir-lease walk made this worse.  When `expire_dir_lease` is\n`false` (i.e. we have no intention of reclaiming dir leases),\n__dir_lease_check() returned `TOUCH` for every valid lease.  `TOUCH`\nmoves the dentry to the tail of the list and resets `di-\u003etime` via\n__dentry_dir_lease_touch(), so a walk over N valid leases pointlessly\nrewrote the list, refreshed the timestamps (preventing them from ever\naging out) and always drained `nr_to_scan`, guaranteeing the `-EAGAIN`\nrequeue.\n\nFix this in three steps:\n\n - Return `KEEP` instead of `TOUCH` when `expire_dir_lease` is\n   `false`.  If we are not going to reclaim the lease, leave it in\n   place instead of churning the list and resetting its timestamp; the\n   walk then terminates naturally (or via `STOP` at the first fresh\n   lease).\n\n - Only return `-EAGAIN` from the first (dentry-lease) walk when something\n   was actually freed.  A full batch that frees nothing means retrying\n   the same list immediately is futile; fall through to the dir-lease\n   walk instead.\n\n - After both walks, bail out with success (0) when nothing was freed\n   and there is no cap pressure (`count==0`).  There is no reason to\n   keep retrying when we are not over the cap limit and made no\n   progress.\n\nUnder real cap pressure (`count\u003e0`) the reclaim path is unchanged and\nstill retries via `-EAGAIN`.\n\nWithout this patch, I saw 500 ceph_trim_dentries() calls per second on\nour web servers.  This is very visible in `/proc/lock_stat` (5 minute\ncapture):\n\n              class name    con-bounces    contentions   waittime-min   waittime-max waittime-total   waittime-avg    acq-bounces   acquisitions   holdtime-min   holdtime-max holdtime-total   holdtime-avg\n\n \u0026mdsc-\u003edentry_list_lock:        126180         128218           0.04        8063.44    15986965.20         124.69        1573354        5296812           0.04        8291.28    74164526.48          14.00\n -----------------------\n \u0026mdsc-\u003edentry_list_lock         111736          [\u003c000000007b11e319\u003e] __ceph_dentry_dir_lease_touch+0x7c/0xa8\n \u0026mdsc-\u003edentry_list_lock           2631          [\u003c0000000050597999\u003e] __dentry_leases_walk+0x64/0x2c8\n \u0026mdsc-\u003edentry_list_lock           3878          [\u003c00000000c0022f62\u003e] __ceph_dentry_lease_touch+0x5c/0xa8\n \u0026mdsc-\u003edentry_list_lock           9973          [\u003c000000002f27cb6f\u003e] __dentry_lease_unlist+0x50/0xa0\n -----------------------\n \u0026mdsc-\u003edentry_list_lock         123621          [\u003c0000000050597999\u003e] __dentry_leases_walk+0x64/0x2c8\n \u0026mdsc-\u003edentry_list_lock           1822          [\u003c000000007b11e319\u003e] __ceph_dentry_dir_lease_touch+0x7c/0xa8\n \u0026mdsc-\u003edentry_list_lock           2720          [\u003c000000002f27cb6f\u003e] __dentry_lease_unlist+0x50/0xa0\n \u0026mdsc-\u003edentry_list_lock             55          [\u003c00000000c0022f62\u003e] __ceph_dentry_lease_touch+0x5c/0xa8\n\nWith this patch:\n\n              class name    con-bounces    contentions   waittime-min   waittime-max waittime-total   waittime-avg    acq-bounces   acquisitions   holdtime-min   holdtime-max holdtime-total   holdtime-avg\n\n \u0026mdsc-\u003edentry_list_lock:          1203           1215           0.16         408.88       33082.88          27.23        4320501        7357389           0.04         500.64     1961578.00           0.27\n -----------------------\n \u0026mdsc-\u003edentry_list_lock           1029          [\u003c000000003c9aea8a\u003e] __ceph_dentry_dir_lease_touch+0x7c/0xa8\n \u0026mdsc-\u003edentry_list_lock            1\n---truncated---","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ceph: do not repeat ceph_trim_dentries() if no progress possible","id":"CVE-2026-89647","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"ceph: cap delegated inode count in ceph_parse_deleg_inos()","id":"CVE-2026-89648"},"packages":[],"prev":{"headline":"ceph: fix leaked inode reference on writeback abort at umount","id":"CVE-2026-89646"},"products":["Linux"],"published":"2026-09-11","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-21","vendors":["Linux"]},"summary":"A logic error in the Linux kernel's Ceph client causes a busy loop consuming CPU when no dentries can be reclaimed, leading to denial of service.","url":"https://insights.sbomify.com/CVE-2026-89647/"}