CVE-2026-89646

Received Received - Intake

Reference Leak in Ceph Kernel Module During Umount

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount ceph_dirty_folio() takes a wrbuffer claim on each newly dirtied folio: it bumps i_wrbuffer_ref (taking an ihold() on the 0->1 transition) and attaches the snap_context to folio->private. That claim is released only by ceph_put_wrbuffer_cap_refs(), which for a submitted write runs from writepages_finish(). In ceph_submit_write(), if ceph_inc_osd_stopping_blocker() fails -- which happens during umount -- the request is aborted before submission: the already-collected folios are only redirtied and unlocked, so writepages_finish() never runs and the claim is leaked. redirty_page_for_writepage() -> folio_redirty_for_writepage() -> filemap_dirty_folio() sets PG_dirty directly and does not go through ->dirty_folio, so ceph_dirty_folio() is not re-entered to rebalance it. Because every subsequent writeback also fails the osd_stopping_blocker, i_wrbuffer_ref never returns to 0, the ihold() is never dropped, and the inode cannot be evicted: VFS: Busy inodes after unmount of ceph kernel BUG at fs/super.c:650! Release the orphaned claim in the abort path before redirtying, via ceph_undo_wrbuffer_claim(): detach the snap_context, drop the wrbuffer reference (letting i_wrbuffer_ref reach 0 and iput() the inode), and drop the snap_context reference -- i.e. do what writepages_finish() would have done for these never-submitted folios. Only the locked_pages entries are undone; folios still in the fbatch were never dirty-cleared by this call (folio_clear_dirty_for_io() is the ownership-transfer point, and a successful move NULLs the fbatch slot), so they hold no claim this call owns.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89646

EUVD

EUVD-2026-76558

Affected Vendors & Products

Vendor	Product	Version / Range
ceph	ceph	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a leaked inode reference during writeback abort at umount in the Ceph filesystem. When ceph_inc_osd_stopping_blocker() fails during umount, write requests are aborted before submission. This causes the inode reference count (i_wrbuffer_ref) to remain elevated, preventing the inode from being evicted. The kernel then reports busy inodes after unmount, leading to a kernel bug.

Detection Guidance

This vulnerability is specific to the Linux kernel's Ceph filesystem implementation and may not have direct detection commands. Monitor kernel logs for messages like 'Busy inodes after unmount of ceph' or 'kernel BUG at fs/super.c:650!' during system shutdown or unmount operations.

Impact Analysis

This vulnerability can cause the system to fail to unmount the Ceph filesystem properly. It may lead to kernel panics or errors due to busy inodes after unmount. Systems relying on Ceph for storage could experience instability or crashes during shutdown or unmount operations.

Mitigation Strategies

Apply the kernel patch that resolves this issue. Since this is a kernel-level vulnerability, updating to a patched kernel version is the primary mitigation. Avoid unmounting Ceph filesystems during active write operations if a patch is not immediately available.

Hi! I’m here to help you understand CVE-2026-89646. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70