CVE-2026-89654

Received Received - Intake

Use-After-Free in Linux Kernel Ceph Client

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in check_new_map() on session freed during unlock check_new_map() iterates mdsc->sessions[] and for each active session drops mdsc->mutex to perform per-session operations. The forced-close path (rank removed from map) correctly takes a reference on s via ceph_get_mds_session() before releasing mdsc->mutex, but three other paths do not: Path A (address changed): mutex_unlock → mutex_lock(&s->s_mutex) Path B (reconnect): mutex_unlock → send_mds_reconnect(mdsc, s) Path C (active transition): mutex_unlock → mutex_lock(&s->s_mutex) Without the extra reference, another thread can acquire mdsc->mutex during the unlock window, call __unregister_session() which drops the last reference on s, and free it. The original thread then accesses freed memory via s->s_mutex. Fix by adding ceph_get_mds_session(s) before each mutex_unlock and ceph_put_mds_session(s) after the corresponding mutex_lock, matching the pattern already used in the forced-close path. Race timeline (Path A): Thread A (check_new_map) Thread B (another map update holds mdsc->mutex or session teardown) -------------------------- -------------------------- s = mdsc->sessions[i] (refcount == 1, held only by sessions[] array) mutex_unlock(&mdsc->mutex) ---> acquires mdsc->mutex __unregister_session(mdsc, s) sessions[i] = NULL ceph_put_mds_session(s) refcount: 1 -> 0 kfree(s) <--- freed! mutex_lock(&s->s_mutex) UAF on freed s->s_mutex

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89654

EUVD

EUVD-2026-76566

Affected Vendors & Products

Vendor	Product	Version / Range
ceph	ceph	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's Ceph file system component. It occurs in the check_new_map() function when handling session cleanup. The issue arises because three code paths drop a mutex without properly referencing a session object, allowing another thread to free the session while the original thread still tries to access it after reacquiring the mutex.

Detection Guidance

This vulnerability is specific to the Linux kernel's Ceph filesystem component and requires kernel-level detection. There are no direct network or system commands to detect this UAF issue as it involves race conditions in kernel memory. Monitoring kernel logs for crashes or oops related to ceph or mds services may indicate exploitation. Kernel debugging tools like crash or kdump could help analyze memory corruption if suspected.

Impact Analysis

This vulnerability could lead to system crashes, data corruption, or potential privilege escalation if exploited. It specifically affects systems using Ceph distributed storage, potentially causing instability in file operations or unauthorized access to sensitive data.

Mitigation Strategies

Apply the kernel patch that fixes the UAF in check_new_map() for the Ceph filesystem. Update to a kernel version containing the fix. If immediate patching is not possible, consider disabling the Ceph MDS service temporarily if it is not critical to operations. Monitor vendor advisories for Ceph or Linux distributions for updates addressing this issue.

Hi! I’m here to help you understand CVE-2026-89654. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70