CVE-2026-89654
Critical · 9.8CVSS
9.8
EPSS
0.6%
Published
Sep 11, 2026
CISA due date
—
Cloudanix analysis
A memory-handling mistake in the Linux kernel's Ceph filesystem support could let an attacker crash systems or run malicious code during routine map updates.
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- Moderate
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Use After Free
- Remediation
- Patch
- Effort
- Medium
- Patch risk
- Low
What it actually does
Use-after-free in Linux kernel Ceph MDS client: check_new_map() drops mdsc mutex while holding a session pointer; concurrent __unregister_session can free the session, so later access to s->s_mutex dereferences freed memory.
Why it matters to the business
Remote attackers could crash or potentially execute code on Ceph clients; low current exploit likelihood but high severity means any widespread Ceph deployment carries latent risk until patched.
How an attack unfolds
An attacker induces concurrent MDS map updates or forced session teardown while check_new_map iterates sessions; the window between mutex_unlock and subsequent lock or send allows another thread to free the session, resulting in UAF when the original thread touches freed memory.
How to fix it
Update to a kernel containing the referenced fix that inserts ceph_get_mds_session before each of the three mutex_unlock sites in check_new_map and the matching ceph_put_mds_session after the subsequent lock or send operation.
How to confirm the fix worked
Inspect Ceph MDS client source for ceph_get_mds_session calls bracketing the mutex operations in check_new_map that match the forced-close path pattern; confirm absence of direct s->s_mutex access after an unprotected unlock.
Typical attack path
- Trigger MDS map changes or rank removal to start check_new_map
- Force competing map update or session teardown during mutex unlock window
- Cause __unregister_session to drop final reference and kfree the session
- Access freed s->s_mutex from original check_new_map path
How to detect it
Review kernel logs for Ceph MDS client crashes or warnings referencing mdsc sessions, check_new_map, or use-after-free reports around session teardown; correlate with unusual MDS map update frequency.
What your security team should do
- Apply the upstream Ceph UAF fix to all Ceph client kernels
- Inventory systems running Ceph MDS client code
- Monitor kernel update channels for Ceph-related patches
- Consider temporary Ceph client isolation if unpatched systems face untrusted MDS servers
The record
In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in check_new_map() on session freed during unlock check_new_map() iterates mdsc->sessions[] and for each active session drops mdsc->mutex to perform per-session operations. The forced-close path (rank removed from map) correctly takes a reference on s via ceph_get_mds_session() before releasing mdsc->mutex, but three other paths do not: Path A (address changed): mutex_unlock → mutex_lock(&s->s_mutex) Path B (reconnect): mutex_unlock → send_mds_reconnect(mdsc, s) Path C (active transition): mutex_unlock → mutex_lock(&s->s_mutex) Without the extra reference, another thread can acquire mdsc->mutex during the unlock window, call __unregister_session() which drops the last reference on s, and free it. The original thread then accesses freed memory via s->s_mutex. Fix by adding ceph_get_mds_session(s) before each mutex_unlock and ceph_put_mds_session(s) after the corresponding mutex_lock, matching the pattern already used in the forced-close path. Race timeline (Path A): Thread A (check_new_map) Thread B (another map update holds mdsc->mutex or session teardown) -------------------------- -------------------------- s = mdsc->sessions[i] (refcount == 1, held only by sessions[] array) mutex_unlock(&mdsc->mutex) ---> acquires mdsc->mutex __unregister_session(mdsc, s) sessions[i] = NULL ceph_put_mds_session(s) refcount: 1 -> 0 kfree(s) <--- freed! mutex_lock(&s->s_mutex) UAF on freed s->s_mutex
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|