CVE-2026-89655: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89655 Overview

CVE-2026-89655 is a use-after-free (UAF) vulnerability in the Linux kernel's Ceph distributed filesystem client. The flaw exists in the __kick_flushing_caps() function, which iterates the ci->i_cap_flush_list list while temporarily dropping the i_ceph_lock to send cap messages. During that unlock window, a concurrent handle_cap_flush_ack() call can detach and free the current list entry through ceph_free_cap_flush(). When the original thread reacquires the lock and advances the loop via list_next_entry(cf, i_list), it dereferences freed memory.

Critical Impact
A race condition between cap flushing and MDS FLUSH_ACK processing can trigger a use-after-free in kernel memory, leading to kernel memory corruption, denial of service, or potential privilege escalation.

Affected Products

Linux kernel with Ceph client (fs/ceph) enabled
Distributions shipping affected upstream kernel versions
Systems mounting CephFS volumes via the in-kernel client

Discovery Timeline

2026-09-11 - CVE-2026-89655 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89655

Vulnerability Analysis

The vulnerability resides in __kick_flushing_caps() within the Linux kernel Ceph client. The function walks ci->i_cap_flush_list using list_for_each_entry() and sends FLUSH messages to the Metadata Server (MDS) for each cap flush entry. Sending a cap message requires releasing i_ceph_lock, which opens a race window.

While the lock is released, the MDS may respond with a FLUSH_ACK message. The response handler handle_cap_flush_ack() acquires i_ceph_lock, detaches all cap flush entries with tid <= flush_tid from the list, releases the lock, and frees the entries via ceph_free_cap_flush(). The original iterating thread has no awareness that its current cursor cf has been reaped.

When the iterator reacquires i_ceph_lock and the loop macro advances with cf = list_next_entry(cf, i_list), it reads cf->i_list.next from freed memory. This constitutes a classic use-after-free [CWE-416] against kernel heap-allocated struct ceph_cap_flush objects.

Root Cause

The root cause is unsafe list iteration across a lock drop. list_for_each_entry() assumes the current node remains valid between iterations, but the code path explicitly releases i_ceph_lock mid-iteration to perform I/O. No reference counting, node pinning, or next-pointer caching protects the cursor from concurrent detach-and-free by handle_cap_flush_ack().

Attack Vector

The race requires a Ceph client mounted against an MDS that returns FLUSH_ACK quickly enough to overlap with __kick_flushing_caps() iteration. A local attacker with the ability to trigger cap flush activity on a CephFS mount, or a malicious or compromised MDS returning crafted acknowledgements, can drive the race. Successful triggering corrupts kernel memory and can cause a kernel panic, information disclosure, or, with additional heap-shaping primitives, escalation of privilege.

No verified public exploit code is available. The upstream fix converts the affected loop to a manual while construct that saves the next pointer under i_ceph_lock before releasing it, ensuring the potentially freed cf is never dereferenced after the unlock window.

Detection Methods for CVE-2026-89655

Indicators of Compromise

Kernel oops or panic messages referencing __kick_flushing_caps, ceph_free_cap_flush, or list_next_entry in stack traces
KASAN reports flagging use-after-free reads on struct ceph_cap_flush allocations
Unexpected CephFS client reboots correlated with high cap-flush activity or MDS failover events

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test kernels to surface UAF conditions during CephFS workload testing
Monitor dmesg and journald for kernel warnings originating from fs/ceph/caps.c
Correlate CephFS client crashes with MDS FLUSH_ACK traffic patterns to identify the race signature

Monitoring Recommendations

Aggregate kernel crash telemetry from CephFS clients into a central SIEM for pattern analysis
Track running kernel versions across the fleet and alert on hosts still on vulnerable builds
Watch for repeated ceph: subsystem faults on systems with sustained metadata-heavy workloads

How to Mitigate CVE-2026-89655

Immediate Actions Required

Inventory all Linux hosts mounting CephFS via the in-kernel client and identify vulnerable kernel builds
Schedule kernel updates to versions containing the upstream fix for __kick_flushing_caps()
Restrict local user access on Ceph client nodes to reduce the population able to trigger cap flush activity

Patch Information

The fix was committed across multiple stable branches. Apply the patch series referenced in the kernel.org commits: Kernel Git Commit 1, Kernel Git Commit 2, Kernel Git Commit 3, Kernel Git Commit 4, Kernel Git Commit 5, Kernel Git Commit 6, Kernel Git Commit 7, and Kernel Git Commit 8. The change replaces the list_for_each_entry() macro with a manual iteration that caches the next pointer under i_ceph_lock prior to release.

Workarounds

Unmount CephFS on affected hosts where operationally feasible until patches are applied
Prefer userspace CephFS access via libcephfs/FUSE where kernel updates cannot be scheduled immediately
Reduce concurrent metadata pressure on affected clients to narrow the race window until patched

bash

# Verify running kernel version and confirm CephFS mounts
uname -r
mount -t ceph

# Apply distribution kernel updates (example: Debian/Ubuntu)
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | cut -d- -f3-)
sudo reboot