CVE-2026-89654: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89654 Overview

CVE-2026-89654 is a use-after-free (UAF) vulnerability in the Linux kernel's Ceph distributed filesystem client. The flaw resides in the check_new_map() function within the Ceph MDS (Metadata Server) client code. When iterating mdsc->sessions[], the function drops mdsc->mutex on three code paths without first taking a reference on the session structure. A concurrent thread can call __unregister_session() during the unlock window, drop the last reference, and free the session. The original thread then dereferences freed memory via s->s_mutex.

Critical Impact
A race condition allows freeing of an in-use session structure, enabling kernel memory corruption that can lead to privilege escalation, denial of service, or arbitrary code execution in kernel context.

Affected Products

Linux kernel with Ceph filesystem client (fs/ceph) enabled
Systems mounting CephFS volumes
Distributions shipping the vulnerable Ceph MDS client code prior to the fix

Discovery Timeline

2026-09-11 - CVE-2026-89654 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89654

Vulnerability Analysis

The vulnerability is a classic use-after-free triggered by a race condition in Ceph session management. check_new_map() walks the mdsc->sessions[] array and performs per-session operations that require dropping mdsc->mutex. The forced-close path correctly protects the session by calling ceph_get_mds_session() before releasing the mutex. Three other paths omit this reference count increment: the address-changed path, the reconnect path, and the active-transition path.

During the unlock window, a second thread can acquire mdsc->mutex, call __unregister_session(), clear the array slot, and invoke ceph_put_mds_session(). If the array slot held the last reference, the session is freed via kfree(s). The original thread then attempts mutex_lock(&s->s_mutex) on freed memory, corrupting kernel state.

Exploitation requires triggering concurrent Ceph MDS map updates or session teardown events. Successful exploitation can result in kernel memory corruption, information disclosure, denial of service, or elevation of privilege depending on how the freed slab memory is reused.

Root Cause

The root cause is missing reference counting on struct ceph_mds_session objects across mutex-drop windows. Three paths in check_new_map() — Path A (address changed), Path B (reconnect via send_mds_reconnect()), and Path C (active transition) — fail to call ceph_get_mds_session() before mutex_unlock(&mdsc->mutex). This deviates from the established pattern used in the forced-close path.

Attack Vector

The attack requires local access to a system with a mounted CephFS filesystem or the ability to trigger Ceph MDS map updates. An attacker induces concurrent operations that cause check_new_map() to execute alongside a session teardown. Winning the race frees the session structure while check_new_map() still holds a raw pointer to it, allowing kernel memory corruption when the freed memory is accessed or reallocated.

No verified public exploit code is available. See the upstream fix in Linux Kernel Commit 21d5be0 and Linux Kernel Commit ee611a7 for the code-level correction.

Detection Methods for CVE-2026-89654

Indicators of Compromise

Kernel oops or panic messages referencing check_new_map, ceph_mds_session, or s_mutex in dmesg output
KASAN (Kernel Address Sanitizer) reports flagging use-after-free in fs/ceph/mds_client.c
Unexpected CephFS client disconnections coinciding with MDS map updates

Detection Strategies

Enable KASAN on test kernels to surface the UAF during Ceph stress testing
Monitor kernel ring buffer for slab corruption warnings and RCU stalls involving Ceph symbols
Audit installed kernel versions against the fixed commits to identify vulnerable hosts

Monitoring Recommendations

Collect dmesg and /var/log/kern.log centrally and alert on Ceph-related crash signatures
Track Ceph MDS map change frequency; abnormal churn combined with client crashes may indicate exploitation attempts
Inventory hosts with CephFS mounts and correlate with kernel package versions

How to Mitigate CVE-2026-89654

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 21d5be0 and ee611a7 as soon as vendor builds are available
Update to a kernel release from your distribution that incorporates the fix
Reboot affected systems after patching to load the corrected kernel

Patch Information

The fix adds ceph_get_mds_session(s) before each mutex_unlock(&mdsc->mutex) and a matching ceph_put_mds_session(s) after the subsequent mutex_lock(&s->s_mutex) on all three affected paths. This mirrors the existing pattern used in the forced-close path. Reference commits: Linux Kernel Commit 21d5be0 and Linux Kernel Commit ee611a7.

Workarounds

Unmount CephFS volumes on hosts where the mount is not strictly required until patches are applied
Restrict local user access on systems with active CephFS mounts to reduce race-triggering opportunities
Avoid frequent MDS map changes or rank reconfigurations on production clusters running vulnerable clients

bash

# Verify running kernel version and check for CephFS mounts
uname -r
mount -t ceph

# Unmount CephFS as a temporary mitigation where feasible
umount -t ceph -a