---
id: CVE-2026-89646
title: 'ceph: fix leaked inode reference on writeback abort at umount'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ceph: fix leaked inode reference on writeback abort at umount

  ceph_dirty_folio() takes a wrbuffer claim on each newly dirtied folio: it
  bumps i_wrbuffer_ref (taking an…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-911
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= fd7449d937e7fb3144770592927cf452bf66dbd3 <
    ec32015a955c5d326c5e26610edfdcccd52f2314
  - >-
    Linux >= fd7449d937e7fb3144770592927cf452bf66dbd3 <
    ac7a5a5385762df458d10cccc086a4e079be7409
  - >-
    Linux >= fd7449d937e7fb3144770592927cf452bf66dbd3 <
    c25aee9c630fb86f98d79eccb75765067079b972
  - Linux 6.15
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:50:17.976Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89646'
references:
  - url: 'https://git.kernel.org/stable/c/ec32015a955c5d326c5e26610edfdcccd52f2314'
  - url: 'https://git.kernel.org/stable/c/ac7a5a5385762df458d10cccc086a4e079be7409'
  - url: 'https://git.kernel.org/stable/c/c25aee9c630fb86f98d79eccb75765067079b972'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89646.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89646'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532514'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89646'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89646'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89646.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00173
epssPercentile: 0.0673
scores:
  cna: 7.8
  vendor: 5.5
ingestedAt: '2026-09-14T15:23:07.473Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix leaked inode reference on writeback abort at umount

ceph_dirty_folio() takes a wrbuffer claim on each newly dirtied folio: it
bumps i_wrbuffer_ref (taking an ihold() on the 0->1 transition) and
attaches the snap_context to folio->private.  That claim is released only
by ceph_put_wrbuffer_cap_refs(), which for a submitted write runs from
writepages_finish().

In ceph_submit_write(), if ceph_inc_osd_stopping_blocker() fails -- which
happens during umount -- the request is aborted before submission: the
already-collected folios are only redirtied and unlocked, so
writepages_finish() never runs and the claim is leaked.
redirty_page_for_writepage() -> folio_redirty_for_writepage() ->
filemap_dirty_folio() sets PG_dirty directly and does not go through
->dirty_folio, so ceph_dirty_folio() is not re-entered to rebalance it.
Because every subsequent writeback also fails the osd_stopping_blocker,
i_wrbuffer_ref never returns to 0, the ihold() is never dropped, and the
inode cannot be evicted:

  VFS: Busy inodes after unmount of ceph
  kernel BUG at fs/super.c:650!

Release the orphaned claim in the abort path before redirtying, via
ceph_undo_wrbuffer_claim(): detach the snap_context, drop the wrbuffer
reference (letting i_wrbuffer_ref reach 0 and iput() the inode), and drop
the snap_context reference -- i.e. do what writepages_finish() would have
done for these never-submitted folios.

Only the locked_pages entries are undone; folios still in the fbatch were
never dirty-cleared by this call (folio_clear_dirty_for_io() is the
ownership-transfer point, and a successful move NULLs the fbatch slot), so
they hold no claim this call owns.

## Affected

- `Linux >= fd7449d937e7fb3144770592927cf452bf66dbd3 < ec32015a955c5d326c5e26610edfdcccd52f2314`
- `Linux >= fd7449d937e7fb3144770592927cf452bf66dbd3 < ac7a5a5385762df458d10cccc086a4e079be7409`
- `Linux >= fd7449d937e7fb3144770592927cf452bf66dbd3 < c25aee9c630fb86f98d79eccb75765067079b972`
- `Linux 6.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10 · no fix planned: Red Hat Enterprise Linux 10 · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89646.json)