CVE-2026-89646: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89646 Overview

CVE-2026-89646 is a Linux kernel vulnerability in the Ceph filesystem client. The flaw causes an inode reference leak when writeback is aborted during unmount. When ceph_submit_write() aborts a request because ceph_inc_osd_stopping_blocker() fails, the wrbuffer claim taken by ceph_dirty_folio() is never released. This prevents i_wrbuffer_ref from reaching zero and leaves the inode busy after unmount, triggering a kernel BUG at fs/super.c:650.

Critical Impact
A local user able to trigger writeback failures during a Ceph unmount can force a kernel panic, resulting in denial of service on the affected host.

Affected Products

Linux kernel Ceph client (fs/ceph/)
Systems mounting CephFS filesystems
Distributions shipping the vulnerable kernel revisions referenced in the upstream commits

Discovery Timeline

2026-09-11 - CVE-2026-89646 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89646

Vulnerability Analysis

The Ceph client tracks writeback state per dirtied folio through a reference-counted claim mechanism. When ceph_dirty_folio() marks a folio dirty, it increments i_wrbuffer_ref and calls ihold() on the 0->1 transition. It also attaches the snap_context pointer to folio->private. The claim is normally released only by ceph_put_wrbuffer_cap_refs(), invoked from writepages_finish() after the OSD write completes.

During unmount, ceph_inc_osd_stopping_blocker() fails and ceph_submit_write() aborts the request before it reaches the OSD. The already-collected folios are redirtied through redirty_page_for_writepage() and unlocked, but writepages_finish() never runs. Every subsequent writeback attempt fails the same blocker check, so the leaked references accumulate.

Root Cause

The redirty path uses folio_redirty_for_writepage(), which calls filemap_dirty_folio() directly and sets PG_dirty without invoking the ->dirty_folio address-space operation. Because ceph_dirty_folio() is bypassed on the re-dirty path, no rebalancing of i_wrbuffer_ref occurs. The inode reference held by ihold() is never dropped, so the VFS cannot evict the inode. On unmount this produces VFS: Busy inodes after unmount of ceph followed by kernel BUG at fs/super.c:650.

Attack Vector

The attack vector is local. A user with the ability to write to a mounted CephFS instance and initiate or observe an unmount can trigger the abort path. Any workload that dirties pages faster than they can be flushed during an unmount race will exercise the leak. Successful triggering panics the kernel and denies service to all workloads on the host.

The fix introduces ceph_undo_wrbuffer_claim() in the abort path. Before redirtying, the function detaches snap_context from folio->private, drops the wrbuffer reference so i_wrbuffer_ref reaches zero and iput() releases the inode, and drops the snap_context reference. Only locked_pages entries are undone because folios still in the fbatch were never dirty-cleared by the call. See the upstream fix at Linux Kernel Commit ac7a5a5385762df458d10cccc086a4e079be7409.

Detection Methods for CVE-2026-89646

Indicators of Compromise

Kernel log message VFS: Busy inodes after unmount of ceph preceding a panic
kernel BUG at fs/super.c:650! in dmesg or the serial console
Repeated Ceph OSD stopping blocker warnings during unmount operations

Detection Strategies

Monitor dmesg and kernel ring buffer output for the busy-inode message tied to CephFS unmounts
Inventory kernel versions across Linux fleet and cross-reference against the fixed commits listed by kernel.org
Track umount exit codes and post-umount kernel state for hosts that mount CephFS

Monitoring Recommendations

Forward /var/log/kern.log and journald kernel facility events to a centralized log platform for pattern matching
Alert on any occurrence of fs/super.c:650 BUG traces across Linux endpoints and servers
Correlate Ceph client unmount events with node reboots or kernel panics to identify affected hosts

How to Mitigate CVE-2026-89646

Immediate Actions Required

Apply the upstream kernel patches referenced by the stable tree commits before scheduling planned CephFS unmounts
Reboot into a patched kernel on hosts that mount CephFS in production
Restrict local shell access on Ceph client hosts to trusted administrators until patched

Patch Information

Upstream fixes are available in the following stable kernel commits: ac7a5a5385762df458d10cccc086a4e079be7409, c25aee9c630fb86f98d79eccb75765067079b972, and ec32015a955c5d326c5e26610edfdcccd52f2314. Apply the distribution-supplied kernel package that incorporates the ceph_undo_wrbuffer_claim() fix in fs/ceph/addr.c.

Workarounds

Quiesce writers to CephFS mounts before issuing umount to reduce the window in which the abort path is exercised
Use umount -l (lazy unmount) with caution and only when writeback has been confirmed complete via sync
Avoid triggering unmount while OSD connectivity is degraded, since blocker failures increase the leak probability

bash

# Verify running kernel version and confirm patch level
uname -r

# Flush pending writes before unmount to minimize exposure
sync && sync
umount /mnt/cephfs

# Monitor kernel log for the vulnerable code path
dmesg -T | grep -E 'Busy inodes after unmount of ceph|fs/super.c:650'