CVE-2026-89990

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ceph: lock mutex in ceph_mds_check_access()

MDS session OPEN handling replaces mdsc->s_cap_auths under

mdsc->mutex, freeing the previous array and its strings.

ceph_mds_check_access() traverses this array without holding the

mutex. A concurrent session reopen can therefore free the array while

it is being inspected, resulting in a use-after-free like this:

Unable to handle kernel paging request at virtual address 003aaad64b2c8bb9

[...]

Internal error: Oops: 0000000096000004 [#1] SMP

Modules linked in:

CPU: 56 UID: 2953037534 PID: 1253231 Comm: php-cgi8.4 Not tainted 6.18.45-i2-ampere #1146 NONE

[..]

pc : ceph_mds_check_access+0xd4/0x550

lr : ceph_mds_check_access+0xc8/0x550

[...]

Call trace:

ceph_mds_check_access+0xd4/0x550 (P)

ceph_atomic_open+0x138/0xbe8

path_openat+0xa24/0xfa8

do_filp_open+0x94/0x158

do_sys_openat2+0x88/0xf8

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References