CVE-2026-89655

Received Received - Intake

Use-After-Free in Linux Kernel CephFS

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock list_for_each_entry() iterates ci->i_cap_flush_list but drops i_ceph_lock to send cap messages. During the unlock window, handle_cap_flush_ack() can acquire i_ceph_lock, detach cf entries with tid <= flush_tid from the list, release i_ceph_lock, and free them via ceph_free_cap_flush() outside any lock. When the original thread reacquires i_ceph_lock and the for-loop macro advances via cf = list_next_entry(cf, i_list), it dereferences cf->i_list.next on freed memory. The race timeline: __kick_flushing_caps() handle_cap_flush_ack() ----------------------- ----------------------- holds i_ceph_lock <--- iterates to cf (tid=10) prepares FLUSH message drops i_ceph_lock <--- __send_cap() ── FLUSH(tid=10) MDS sends FLUSH_ACK(tid=10) ---> acquires i_ceph_lock cf->tid(10) <= flush_tid(10), detaches cf from i_cap_flush_list drops i_ceph_lock ceph_free_cap_flush(cf) <- frees it! acquires i_ceph_lock <--- for-loop advances: cf = list_next_entry(cf, i_list) -- UAF on freed cf->i_list.next The cf was just sent by __kick_flushing_caps itself via __send_cap(). The MDS may respond with FLUSH_ACK quickly enough that handle_cap_flush_ack() frees cf before __kick_flushing_caps can finish the iteration. Fix by converting to a manual while loop: save the next pointer under i_ceph_lock before dropping it, then use the saved pointer after reacquiring, so the potentially-freed cf is never accessed again.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89655

EUVD

EUVD-2026-76567

Affected Vendors & Products

Vendor	Product	Version / Range
ceph	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's Ceph file system component. It occurs in the __kick_flushing_caps() function where a race condition allows freed memory to be accessed. The issue arises when the function iterates over a list of capabilities while temporarily releasing a lock, allowing another process to free the memory before the iteration completes.

Detection Guidance

This vulnerability is specific to the Linux kernel's Ceph filesystem implementation and requires kernel-level detection. There are no direct network or system commands to detect this UAF issue as it involves race conditions in kernel memory management. Monitoring kernel logs for crashes or errors related to Ceph operations may indicate exploitation or instability.

Impact Analysis

This vulnerability could lead to system crashes, data corruption, or potential privilege escalation if exploited. Systems using Ceph file systems in the Linux kernel may be affected, potentially causing instability or security breaches.

Mitigation Strategies

Apply the kernel patch that fixes this issue by converting the list iteration to a manual while loop to prevent UAF. Update to a Linux kernel version that includes the fix for CVE-2026-89655. If patching is not immediately possible, consider disabling Ceph-related services temporarily to reduce exposure.

Hi! I’m here to help you understand CVE-2026-89655. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70