The vulnerability in the Linux kernel Ceph filesystem involves a leaked inode reference when a writeback is aborted during unmount. Specifically, ceph_dirty_folio() increments an inode writebuffer reference and attaches a snap_context to a folio. If ceph_inc_osd_stopping_blocker() fails during ceph_submit_write() (such as during unmount), the write request is aborted before submission, but the folios are only redirtied and unlocked without releasing the inode reference. This causes the inode reference count to never return to zero, preventing inode eviction and potentially causing kernel bugs. The patch releases the orphaned claim in the abort path by detaching the snap_context, dropping the wrbuffer reference, and dropping the snap_context reference, mimicking the cleanup normally done by writepages_finish().

The vulnerability causes leaked inode references during Ceph filesystem unmount operations, which can prevent inode eviction and lead to kernel bugs such as 'VFS: Busy inodes after unmount of ceph' and kernel panics. This impacts system stability and reliability during unmount operations involving Ceph.

A fix has been implemented in the Linux kernel to properly release leaked inode references during writeback aborts at unmount in the Ceph filesystem. Users should apply the official kernel update containing this patch to resolve the issue. No additional mitigation is required once the patch is applied.