CVE-2026-80528

CRITICALPre-NVD 9.89.8—
EchelonGraph scoreHIGH confidence

Score 9.8 from GitHub Security Advisory (severity: CRITICAL) published 2026-08-27. a secondary CVSS source baseline 9.8; sources differ by 0.0.

Triggered by: GitHub Security Advisory CVSS
Sources: epss, ghsa, secondary
Trending — 5 sources updated this week
9.8EG
EchelonGraph verdictPlan a fixSerious severity, but no confirmed exploitation yet.
  • High severity, but no confirmed exploitation yet
CISA-KEV: Not listedEPSS PROB: 1%CVSS: 9.8Exploit: None knownExposed: 0

No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.

In the Linux kernel, the following vulnerability has been resolved:

ceph: avoid fs reclaim while using current->journal_info

handle_reply() stores a ceph_mds_request pointer in current->journal_info while filling the inode and dentry cache from an MDS reply.

An allocation in this section can enter direct reclaim and prune dentries from another filesystem. If this dirties an ext4 inode, ext4 starts a JBD2 transaction. JBD2 interprets the Ceph request in current->journal_info as a journal handle and dereferences the request's r_tid as h_transaction, causing a kernel crash, e.g.:

Unable to handle kernel paging request at virtual address 00000000077b4818 [...] Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 6 UID: 0 PID: 2699135 Comm: kworker/6:3 Tainted: G W 6.18.38-i3 #1113 NONE [...] Workqueue: ceph-msgr ceph_con_workfn pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : jbd2__journal_start+0x2c/0x208 lr : __ext4_journal_start_sb+0x100/0x178 [...] Call trace: jbd2__journal_start+0x2c/0x208 (P) __ext4_journal_start_sb+0x100/0x178 ext4_dirty_inode+0x3c/0x90 __mark_inode_dirty+0x58/0x400 iput.part.0+0x2b0/0x370 iput+0x18/0x30 dentry_unlink_inode+0xc0/0x158 __dentry_kill+0x80/0x250 shrink_dentry_list+0x90/0x130 prune_dcache_sb+0x60/0x98 super_cache_scan+0xe8/0x190 do_shrink_slab+0x174/0x388 shrink_slab+0xd8/0x4c0 shrink_node+0x31c/0x908 do_try_to_free_pages+0xd0/0x508 try_to_free_pages+0x11c/0x238 __alloc_frozen_pages_noprof+0x4d0/0xdd0 __folio_alloc_noprof+0x18/0x70 __filemap_get_folio+0x248/0x440 ceph_readdir_prepopulate+0x570/0x9e8 mds_dispatch+0x1424/0x1ba0 ceph_con_process_message+0x74/0xa0 ceph_con_v1_try_read+0x3a0/0x1510 ceph_con_workfn+0x260/0x460

Enter a scoped NOFS allocation context and leave it after clearing journal_info. This prevents filesystem reclaim from recursing into another filesystem while the field contains Ceph-private data.

CVSS v3
9.8
EG Score
9.8(high)
EG Risk
49(Track)
EG Risk 49/100SSVC: Track

EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).

How it’s computed
Severity98% × 45%
Exploitation1% × 40%
Automatability30% × 15%
Action: Routine — remediate on your standard cadence.
EPSS PROB
1%
EPSS %ILE
42%
KEV
Not listed

Published

August 26, 2026

Last Modified

August 27, 2026

Advisory Details (8)

Auto-updated Aug 27, 2026
No patch confirmed yet.
generic

ceph: avoid fs reclaim while using current->journal_info - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/ca5fa2380dd90a0adb01580fa6225025351a90f6
generic

ceph: avoid fs reclaim while using current->journal_info - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/c8a21660c3b90864c391164eea5622e7b5b2897c
generic

ceph: avoid fs reclaim while using current->journal_info - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/b6a0989613072499633e761a1536428a466de7d3
generic

ceph: avoid fs reclaim while using current->journal_info - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/79d95b43ca090426399651ed580dd9bf2db36ab8
generic

ceph: avoid fs reclaim while using current->journal_info - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/5b602344a49e039e792ce5a8923bcc61412ee134
generic

ceph: avoid fs reclaim while using current->journal_info - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/4dbb2c02558e71f93510a6461d7e798b67426b49
generic

ceph: avoid fs reclaim while using current->journal_info - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/47b745747b3aa39064724a642884f9df924ddf20
generic

ceph: avoid fs reclaim while using current->journal_info - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/00c12f57a87f537fa8779258fb3a03003a99963e

Vendor Advisories for CVE-2026-80528(1)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Data Freshness Timeline

(refreshed 29× in last 7d / 29× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

  1. 2026-08-30 02:29 UTCEG score recompute
  2. 2026-08-30 02:29 UTCGHSA enrichment
  3. 2026-08-30 01:22 UTCEPSS rescore
  4. 2026-08-29 22:42 UTCGHSA enrichment
  5. 2026-08-29 18:55 UTCGHSA enrichment
  6. 2026-08-29 15:08 UTCGHSA enrichment
  7. 2026-08-29 11:21 UTCGHSA enrichment
  8. 2026-08-29 07:31 UTCGHSA enrichment
  9. 2026-08-29 03:44 UTCGHSA enrichment
  10. 2026-08-28 23:58 UTCEG score recompute
  11. 2026-08-28 23:58 UTCGHSA enrichment
  12. 2026-08-28 21:42 UTCEPSS rescore
  13. 2026-08-28 17:01 UTCGHSA enrichment
  14. 2026-08-28 13:10 UTCGHSA enrichment
  15. 2026-08-28 09:21 UTCGHSA enrichment
  16. 2026-08-28 05:32 UTCGHSA enrichment
  17. 2026-08-28 01:39 UTCGHSA enrichment
  18. 2026-08-27 21:53 UTCGHSA enrichment
  19. 2026-08-27 18:06 UTCEG score recompute
  20. 2026-08-27 18:06 UTCGHSA enrichment
  21. 2026-08-27 14:25 UTCEPSS rescore
  22. 2026-08-27 13:55 UTCGHSA enrichment
  23. 2026-08-27 10:08 UTCEG score recompute
  24. 2026-08-27 10:08 UTCGHSA enrichment
  25. 2026-08-27 06:20 UTCEG score recompute▲ 9.80
Show 4 more
  1. 2026-08-27 06:11 UTCMITRE cvelistV5CVSS v3 → 9.8 · severity → CRITICAL
  2. 2026-08-26 15:43 UTCNVD update
  3. 2026-08-26 14:43 UTCEG score recompute
  4. 2026-08-26 14:41 UTCMITRE cvelistV5first tracked

Frequently asked(5)

What is CVE-2026-80528?
CVE-2026-80528 is a critical vulnerability published on August 26, 2026. In the Linux kernel, the following vulnerability has been resolved: ceph: avoid fs reclaim while using current->journal_info handlereply() stores a cephmds_request pointer in current->journal_info while filling the inode and dentry cache from an MDS reply. An allocation in this section can enter…
When was CVE-2026-80528 disclosed?
CVE-2026-80528 was first published in the National Vulnerability Database on August 26, 2026, with the most recent update on August 27, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2026-80528 actively exploited?
CVE-2026-80528 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 1% probability of exploitation in the next 30 days, which ranks it in the top 58.0% of all scored CVEs.
What is the CVSS score of CVE-2026-80528?
CVE-2026-80528 has a CVSS v3 base score of 9.8 (NVD).
How do I remediate CVE-2026-80528?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-80528, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

Explore the affected products and dependency analysis for CVE-2026-80528

Explore →

Is Your Infrastructure Affected by CVE-2026-80528?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs