{"id":"CVE-2026-89655","title":"ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock\n\nlist_for_each_entry() iterates ci->i_cap_flush_list but drops\ni_ceph_lock to send cap messages.…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-366"],"vendor":"Linux","product":"Linux","affected":["Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 < 091137821e1fc88f37e15201abf055c9494ddc61","Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 < 01542430081014d80fc9e70e92d6647432ddb7fc","Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 < 23eb34a53a53cb1a6dab1eeee830633207ac158d","Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 < 19f16f04c2b014a7dd214dc1e42557d8530b16f3","Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 < 2701431aa3cc8b23efe6890182e7b04f5e76fab5","Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 < fe46746087b5b9c5bb2d022df6c7819218494ced","Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 < 2dba24dcd5050be4b7b119e6f0b01f62203b5d26","Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 < 7af4c4f01305b0935adf6d4301b1ec407025485d","Linux 4.8"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-16T19:25:27.776156Z"},"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:50:26.879Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89655","references":[{"url":"https://git.kernel.org/stable/c/091137821e1fc88f37e15201abf055c9494ddc61"},{"url":"https://git.kernel.org/stable/c/01542430081014d80fc9e70e92d6647432ddb7fc"},{"url":"https://git.kernel.org/stable/c/23eb34a53a53cb1a6dab1eeee830633207ac158d"},{"url":"https://git.kernel.org/stable/c/19f16f04c2b014a7dd214dc1e42557d8530b16f3"},{"url":"https://git.kernel.org/stable/c/2701431aa3cc8b23efe6890182e7b04f5e76fab5"},{"url":"https://git.kernel.org/stable/c/fe46746087b5b9c5bb2d022df6c7819218494ced"},{"url":"https://git.kernel.org/stable/c/2dba24dcd5050be4b7b119e6f0b01f62203b5d26"},{"url":"https://git.kernel.org/stable/c/7af4c4f01305b0935adf6d4301b1ec407025485d"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89655.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89655"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532127"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89655"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89655"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89655.mbox"}],"tags":["cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00714,"epssPercentile":0.53476,"scores":{"cna":9.8,"vendor":7},"ingestedAt":"2026-09-14T15:23:07.450Z","slug":"CVE-2026-89655","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock\n\nlist_for_each_entry() iterates ci->i_cap_flush_list but drops\ni_ceph_lock to send cap messages.  During the unlock window,\nhandle_cap_flush_ack() can acquire i_ceph_lock, detach cf entries\nwith tid <= flush_tid from the list, release i_ceph_lock, and free\nthem via ceph_free_cap_flush() outside any lock.  When the original\nthread reacquires i_ceph_lock and the for-loop macro advances via\ncf = list_next_entry(cf, i_list), it dereferences cf->i_list.next\non freed memory.\n\nThe race timeline:\n\n  __kick_flushing_caps()              handle_cap_flush_ack()\n  -----------------------             -----------------------\n  holds i_ceph_lock        <---\n  iterates to cf (tid=10)\n  prepares FLUSH message\n  drops i_ceph_lock        <---\n  __send_cap() ── FLUSH(tid=10)\n\t                              MDS sends FLUSH_ACK(tid=10)\n                           --->       acquires i_ceph_lock\n                                      cf->tid(10) <= flush_tid(10),\n                                      detaches cf from i_cap_flush_list\n                                      drops i_ceph_lock\n                                      ceph_free_cap_flush(cf) <- frees it!\n  acquires i_ceph_lock     <---\n  for-loop advances:\n    cf = list_next_entry(cf, i_list)\n      -- UAF on freed cf->i_list.next\n\nThe cf was just sent by __kick_flushing_caps itself via __send_cap().\nThe MDS may respond with FLUSH_ACK quickly enough that\nhandle_cap_flush_ack() frees cf before __kick_flushing_caps can\nfinish the iteration.\n\nFix by converting to a manual while loop: save the next pointer\nunder i_ceph_lock before dropping it, then use the saved pointer\nafter reacquiring, so the potentially-freed cf is never accessed again.\n\n## Affected\n\n- `Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 < 091137821e1fc88f37e15201abf055c9494ddc61`\n- `Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 < 01542430081014d80fc9e70e92d6647432ddb7fc`\n- `Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 < 23eb34a53a53cb1a6dab1eeee830633207ac158d`\n- `Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 < 19f16f04c2b014a7dd214dc1e42557d8530b16f3`\n- `Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 < 2701431aa3cc8b23efe6890182e7b04f5e76fab5`\n- `Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 < fe46746087b5b9c5bb2d022df6c7819218494ced`\n- `Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 < 2dba24dcd5050be4b7b119e6f0b01f62203b5d26`\n- `Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 < 7af4c4f01305b0935adf6d4301b1ec407025485d`\n- `Linux 4.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89655.json)","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":223255,"id":"CVE-2026-89655","ts":1792180032539,"field":"cvss","old":"7","new":"9.8"},{"seq":223254,"id":"CVE-2026-89655","ts":1792180032539,"field":"severity","old":"high","new":"critical"},{"seq":205536,"id":"CVE-2026-89655","ts":1789576724437,"field":"cvss","old":"9.8","new":"7"},{"seq":205535,"id":"CVE-2026-89655","ts":1789576724437,"field":"severity","old":"critical","new":"high"},{"seq":197789,"id":"CVE-2026-89655","ts":1789384318862,"field":"cvss","old":"5.3","new":"9.8"},{"seq":197788,"id":"CVE-2026-89655","ts":1789384318862,"field":"severity","old":"medium","new":"critical"},{"seq":183377,"id":"CVE-2026-89655","ts":1789356675110,"field":"cvss","old":"9.8","new":"5.3"},{"seq":183376,"id":"CVE-2026-89655","ts":1789356675110,"field":"severity","old":"critical","new":"medium"},{"seq":153508,"id":"CVE-2026-89655","ts":1789285351068,"field":"cvss","old":null,"new":"9.8"},{"seq":153507,"id":"CVE-2026-89655","ts":1789285351068,"field":"severity","old":"none","new":"critical"},{"seq":147698,"id":"CVE-2026-89655","ts":1789270211928,"field":"cvss","old":null,"new":"5.3"},{"seq":147697,"id":"CVE-2026-89655","ts":1789270211928,"field":"severity","old":"none","new":"medium"},{"seq":109450,"id":"CVE-2026-89655","ts":1789183731960,"field":"cvss","old":null,"new":"5.3"},{"seq":109449,"id":"CVE-2026-89655","ts":1789183731960,"field":"severity","old":"none","new":"medium"}]}