{"id":"CVE-2026-89646","title":"ceph: fix leaked inode reference on writeback abort at umount","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix leaked inode reference on writeback abort at umount\n\nceph_dirty_folio() takes a wrbuffer claim on each newly dirtied folio: it\nbumps i_wrbuffer_ref (taking an…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-911"],"vendor":"Linux","product":"Linux","affected":["Linux >= fd7449d937e7fb3144770592927cf452bf66dbd3 < ec32015a955c5d326c5e26610edfdcccd52f2314","Linux >= fd7449d937e7fb3144770592927cf452bf66dbd3 < ac7a5a5385762df458d10cccc086a4e079be7409","Linux >= fd7449d937e7fb3144770592927cf452bf66dbd3 < c25aee9c630fb86f98d79eccb75765067079b972","Linux 6.15"],"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:50:17.976Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89646","references":[{"url":"https://git.kernel.org/stable/c/ec32015a955c5d326c5e26610edfdcccd52f2314"},{"url":"https://git.kernel.org/stable/c/ac7a5a5385762df458d10cccc086a4e079be7409"},{"url":"https://git.kernel.org/stable/c/c25aee9c630fb86f98d79eccb75765067079b972"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89646.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89646"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532514"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89646"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89646"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89646.mbox"}],"tags":["cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00173,"epssPercentile":0.0673,"scores":{"cna":7.8,"vendor":5.5},"ingestedAt":"2026-09-14T15:23:07.473Z","slug":"CVE-2026-89646","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix leaked inode reference on writeback abort at umount\n\nceph_dirty_folio() takes a wrbuffer claim on each newly dirtied folio: it\nbumps i_wrbuffer_ref (taking an ihold() on the 0->1 transition) and\nattaches the snap_context to folio->private.  That claim is released only\nby ceph_put_wrbuffer_cap_refs(), which for a submitted write runs from\nwritepages_finish().\n\nIn ceph_submit_write(), if ceph_inc_osd_stopping_blocker() fails -- which\nhappens during umount -- the request is aborted before submission: the\nalready-collected folios are only redirtied and unlocked, so\nwritepages_finish() never runs and the claim is leaked.\nredirty_page_for_writepage() -> folio_redirty_for_writepage() ->\nfilemap_dirty_folio() sets PG_dirty directly and does not go through\n->dirty_folio, so ceph_dirty_folio() is not re-entered to rebalance it.\nBecause every subsequent writeback also fails the osd_stopping_blocker,\ni_wrbuffer_ref never returns to 0, the ihold() is never dropped, and the\ninode cannot be evicted:\n\n  VFS: Busy inodes after unmount of ceph\n  kernel BUG at fs/super.c:650!\n\nRelease the orphaned claim in the abort path before redirtying, via\nceph_undo_wrbuffer_claim(): detach the snap_context, drop the wrbuffer\nreference (letting i_wrbuffer_ref reach 0 and iput() the inode), and drop\nthe snap_context reference -- i.e. do what writepages_finish() would have\ndone for these never-submitted folios.\n\nOnly the locked_pages entries are undone; folios still in the fbatch were\nnever dirty-cleared by this call (folio_clear_dirty_for_io() is the\nownership-transfer point, and a successful move NULLs the fbatch slot), so\nthey hold no claim this call owns.\n\n## Affected\n\n- `Linux >= fd7449d937e7fb3144770592927cf452bf66dbd3 < ec32015a955c5d326c5e26610edfdcccd52f2314`\n- `Linux >= fd7449d937e7fb3144770592927cf452bf66dbd3 < ac7a5a5385762df458d10cccc086a4e079be7409`\n- `Linux >= fd7449d937e7fb3144770592927cf452bf66dbd3 < c25aee9c630fb86f98d79eccb75765067079b972`\n- `Linux 6.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10 · no fix planned: Red Hat Enterprise Linux 10 · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89646.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":224646,"id":"CVE-2026-89646","ts":1792401456462,"field":"cvss","old":"5.5","new":"7.8"},{"seq":224645,"id":"CVE-2026-89646","ts":1792401456462,"field":"severity","old":"medium","new":"high"},{"seq":203935,"id":"CVE-2026-89646","ts":1789490228347,"field":"cvss","old":"4.4","new":"5.5"},{"seq":202843,"id":"CVE-2026-89646","ts":1789403732636,"field":"cvss","old":"7.8","new":"4.4"},{"seq":202842,"id":"CVE-2026-89646","ts":1789403732636,"field":"severity","old":"high","new":"medium"},{"seq":197811,"id":"CVE-2026-89646","ts":1789384320500,"field":"cvss","old":"4.4","new":"7.8"},{"seq":197810,"id":"CVE-2026-89646","ts":1789384320500,"field":"severity","old":"medium","new":"high"},{"seq":183381,"id":"CVE-2026-89646","ts":1789356675127,"field":"cvss","old":"7.8","new":"4.4"},{"seq":183380,"id":"CVE-2026-89646","ts":1789356675127,"field":"severity","old":"high","new":"medium"},{"seq":153490,"id":"CVE-2026-89646","ts":1789285350773,"field":"cvss","old":null,"new":"7.8"},{"seq":153489,"id":"CVE-2026-89646","ts":1789285350773,"field":"severity","old":"none","new":"high"},{"seq":147073,"id":"CVE-2026-89646","ts":1789270195055,"field":"cvss","old":null,"new":"4.4"},{"seq":147072,"id":"CVE-2026-89646","ts":1789270195055,"field":"severity","old":"none","new":"medium"}]}