{"id":"CVE-2026-89654","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix UAF in check_new_map() on session freed during unlock\n\ncheck_new_map() iterates mdsc->sessions[] and for each active session\ndrops mdsc->mutex to perform per-…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix UAF in check_new_map() on session freed during unlock\n\ncheck_new_map() iterates mdsc->sessions[] and for each active session\ndrops mdsc->mutex to perform per-…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-364"],"vendor":"Linux","product":"Linux","affected":["Linux >= 2f2dc053404febedc9c273452d9d518fb31fde72 < 9646dfee880730aae4b379a4b8ee6c88ac735acd","Linux >= 2f2dc053404febedc9c273452d9d518fb31fde72 < 21d5be092d947f8d83f76f7ebf3989e7e9230a98","Linux >= 2f2dc053404febedc9c273452d9d518fb31fde72 < ee611a7509554c4ca1f54f6aefe592fb1df7ea70","Linux 2.6.34"],"published":"2026-09-11","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:17:54.873","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89654","references":[{"url":"https://git.kernel.org/stable/c/21d5be092d947f8d83f76f7ebf3989e7e9230a98","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9646dfee880730aae4b379a4b8ee6c88ac735acd","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee611a7509554c4ca1f54f6aefe592fb1df7ea70","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89654.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89654"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532045"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89654"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89654"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89654.mbox"},{"url":"https://git.kernel.org/stable/c/352a278d5a1965aae3f817ce5d24a67ee42d45d1"},{"url":"https://git.kernel.org/stable/c/820871e9dbeecd2533c4c5f5d91878ceaf02324c"}],"tags":["nvd","cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00671,"epssPercentile":0.51833,"scores":{"nvd":9.8,"cna":9.8,"vendor":7},"ingestedAt":"2026-09-14T15:23:07.473Z","ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-16T19:25:25.205939Z"},"slug":"CVE-2026-89654","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix UAF in check_new_map() on session freed during unlock\n\ncheck_new_map() iterates mdsc->sessions[] and for each active session\ndrops mdsc->mutex to perform per-session operations.  The forced-close\npath (rank removed from map) correctly takes a reference on s via\nceph_get_mds_session() before releasing mdsc->mutex, but three other\npaths do not:\n\n  Path A (address changed):  mutex_unlock → mutex_lock(&s->s_mutex)\n  Path B (reconnect):        mutex_unlock → send_mds_reconnect(mdsc, s)\n  Path C (active transition): mutex_unlock → mutex_lock(&s->s_mutex)\n\nWithout the extra reference, another thread can acquire mdsc->mutex\nduring the unlock window, call __unregister_session() which drops the\nlast reference on s, and free it.  The original thread then accesses\nfreed memory via s->s_mutex.\n\nFix by adding ceph_get_mds_session(s) before each mutex_unlock and\nceph_put_mds_session(s) after the corresponding mutex_lock, matching\nthe pattern already used in the forced-close path.\n\nRace timeline (Path A):\n\n  Thread A (check_new_map)             Thread B (another map update\n    holds mdsc->mutex                      or session teardown)\n  --------------------------           --------------------------\n  s = mdsc->sessions[i]\n  (refcount == 1, held only by\n   sessions[] array)\n\n  mutex_unlock(&mdsc->mutex)\n                               --->    acquires mdsc->mutex\n                                       __unregister_session(mdsc, s)\n                                         sessions[i] = NULL\n                                         ceph_put_mds_session(s)\n                                           refcount: 1 -> 0\n                                           kfree(s)  <--- freed!\n\n  mutex_lock(&s->s_mutex)\n  UAF on freed s->s_mutex\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89654.json)","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":222160,"id":"CVE-2026-89654","ts":1792062149438,"field":"cvss","old":"7","new":"9.8"},{"seq":222159,"id":"CVE-2026-89654","ts":1792062149438,"field":"severity","old":"high","new":"critical"},{"seq":204244,"id":"CVE-2026-89654","ts":1789490240594,"field":"cvss","old":"4.7","new":"7"},{"seq":204243,"id":"CVE-2026-89654","ts":1789490240594,"field":"severity","old":"medium","new":"high"},{"seq":202836,"id":"CVE-2026-89654","ts":1789403732604,"field":"cvss","old":"9.8","new":"4.7"},{"seq":202835,"id":"CVE-2026-89654","ts":1789403732604,"field":"severity","old":"critical","new":"medium"},{"seq":197799,"id":"CVE-2026-89654","ts":1789384318908,"field":"cvss","old":"4.7","new":"9.8"},{"seq":197798,"id":"CVE-2026-89654","ts":1789384318908,"field":"severity","old":"medium","new":"critical"},{"seq":183383,"id":"CVE-2026-89654","ts":1789356675135,"field":"cvss","old":"9.8","new":"4.7"},{"seq":183382,"id":"CVE-2026-89654","ts":1789356675135,"field":"severity","old":"critical","new":"medium"},{"seq":153506,"id":"CVE-2026-89654","ts":1789285351035,"field":"cvss","old":null,"new":"9.8"},{"seq":153505,"id":"CVE-2026-89654","ts":1789285351035,"field":"severity","old":"none","new":"critical"},{"seq":147778,"id":"CVE-2026-89654","ts":1789270212253,"field":"cvss","old":null,"new":"4.7"},{"seq":147777,"id":"CVE-2026-89654","ts":1789270212253,"field":"severity","old":"none","new":"medium"},{"seq":109538,"id":"CVE-2026-89654","ts":1789183732331,"field":"cvss","old":null,"new":"4.7"},{"seq":109537,"id":"CVE-2026-89654","ts":1789183732331,"field":"severity","old":"none","new":"medium"}]}