CVE-2026-89990 Overview
CVE-2026-89990 is a use-after-free vulnerability in the Linux kernel's Ceph distributed filesystem client. The flaw resides in ceph_mds_check_access(), which traverses the mdsc->s_cap_auths array without holding mdsc->mutex. Concurrent Metadata Server (MDS) session OPEN handling replaces this array under the mutex, freeing the previous array and its strings. A concurrent session reopen can free the array while it is being inspected, resulting in a use-after-free condition. Kernel crash traces show the fault triggering during ceph_atomic_open() under normal filesystem open operations, indicating the race is reachable through standard file access paths.
Critical Impact
An attacker able to trigger MDS session reopens concurrently with filesystem access can achieve a use-after-free in kernel context, potentially leading to kernel memory corruption, denial of service, or privilege escalation on hosts mounting a Ceph filesystem.
Affected Products
- Linux kernel with Ceph client (CephFS) support enabled
- Kernel version 6.18.45 confirmed vulnerable per the reported crash trace
- Systems mounting CephFS via the in-kernel client
Discovery Timeline
- 2026-09-16 - CVE-2026-89990 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89990
Vulnerability Analysis
The vulnerability is a race condition producing a use-after-free [CWE-416] in the Ceph client's access-check path. The Ceph Metadata Server (MDS) client maintains an array of capability authorizations, mdsc->s_cap_auths, describing per-session access rules. When an MDS session OPEN message is processed, the handler acquires mdsc->mutex, replaces the s_cap_auths pointer with a freshly allocated array, and frees the previous array along with its associated strings.
The ceph_mds_check_access() function, invoked during filesystem operations such as ceph_atomic_open(), iterates over s_cap_auths to evaluate access. This iteration proceeds without acquiring mdsc->mutex. If an MDS session is reopened while a thread is walking the array, the reader dereferences memory that the OPEN handler has already released.
The reported oops shows a fault at ceph_mds_check_access+0xd4/0x550 with an invalid virtual address (003aaad64b2c8bb9), consistent with a freed pointer or a freed-and-reallocated string being read. The call chain — do_sys_openat2 → do_filp_open → path_openat → ceph_atomic_open → ceph_mds_check_access — confirms the code path is reachable through any local process performing open() on a CephFS mount.
Root Cause
The root cause is missing synchronization between the reader in ceph_mds_check_access() and the writer in the MDS session OPEN handler. The writer safely publishes a new s_cap_auths array under mdsc->mutex and frees the old one, but the reader traverses the array without any lock, RCU section, or reference count, allowing the memory to be reclaimed mid-traversal.
Attack Vector
Exploitation requires activity on a mounted CephFS filesystem coincident with MDS session state transitions. A local unprivileged process performing open() calls can trigger the reader path, while network conditions or MDS behavior that induce session reopens drive the writer path. Attackers with network positioning to force MDS session resets, combined with a co-resident local workload, can widen the race window. The kernel crash trace shows a normal php-cgi process triggering the fault, indicating the race can occur under ordinary workloads without deliberate manipulation.
No public proof-of-concept exploit is currently available. Verified fix commits are referenced in the upstream stable tree, including Linux Kernel Commit 729c1ff and Linux Kernel Commit a61c6ae1.
Detection Methods for CVE-2026-89990
Indicators of Compromise
- Kernel oops messages referencing ceph_mds_check_access+ in the program counter or link register
- Faults at improbable virtual addresses during ceph_atomic_open or path_openat call chains on CephFS mounts
- KASAN use-after-free reports naming s_cap_auths allocations on kernels built with KASAN enabled
- Unexpected process termination or kernel panics on hosts running CephFS workloads during MDS reconnect events
Detection Strategies
- Correlate MDS session reconnect or OPEN events on Ceph monitors with kernel oops timestamps on client hosts
- Enable KASAN on test kernels to surface use-after-free reports in the Ceph client before production deployment
- Monitor kernel ring buffers with dmesg -w or journald for Unable to handle kernel paging request entries citing Ceph symbols
Monitoring Recommendations
- Ingest kernel logs from CephFS client nodes into a centralized log platform and alert on Oops entries referencing ceph_mds_
- Track MDS session churn on the Ceph cluster; elevated session reopen rates increase the race window
- Baseline crash rates on CephFS clients and alert on statistically significant increases
- Ensure crash dumps (kdump) are configured on CephFS client hosts to capture forensic evidence
How to Mitigate CVE-2026-89990
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the stable tree commits and reboot affected CephFS client hosts
- Prioritize patching on multi-tenant hosts and any system where untrusted local users can invoke open() on CephFS paths
- If patching cannot be immediate, restrict local process access to CephFS mount points to trusted workloads only
- Enable kdump and centralized kernel log collection to capture any exploitation attempts prior to remediation
Patch Information
The fix acquires mdsc->mutex in ceph_mds_check_access() before traversing s_cap_auths, serializing the reader with the MDS session OPEN writer. Verified fix commits are available in the upstream stable tree: Linux Kernel Commit 729c1ff, Linux Kernel Commit a61c6ae1, Linux Kernel Commit ca5bfea, and Linux Kernel Commit df1a97d. Rebuild kernels from a stable branch that includes these commits and validate with regression testing against CephFS workloads.
Workarounds
- Unmount CephFS on hosts where patching is not yet feasible and rely on FUSE-based ceph-fuse as an interim client until kernels are updated
- Reduce MDS session reopen frequency by stabilizing network paths between clients and the Ceph cluster and tuning mds_session_timeout where appropriate
- Limit exposure by restricting the set of local users with access to CephFS mounts through mount namespaces or filesystem permissions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
