CVE-2026-89654

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix UAF in check_new_map() on session freed during unlock

check_new_map() iterates mdsc->sessions[] and for each active session

drops mdsc->mutex to perform per-session operations. The forced-close

path (rank removed from map) correctly takes a reference on s via

ceph_get_mds_session() before releasing mdsc->mutex, but three other

paths do not:

Path A (address changed): mutex_unlock → mutex_lock(&s->s_mutex)

Path B (reconnect): mutex_unlock → send_mds_reconnect(mdsc, s)

Path C (active transition): mutex_unlock → mutex_lock(&s->s_mutex)

Without the extra reference, another thread can acquire mdsc->mutex

during the unlock window, call __unregister_session() which drops the

last reference on s, and free it. The original thread then accesses

freed memory via s->s_mutex.

Fix by adding ceph_get_mds_session(s) before each mutex_unlock and

ceph_put_mds_session(s) after the corresponding mutex_lock, m

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References