---
id: CVE-2026-89654
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ceph: fix UAF in check_new_map() on session freed during unlock

  check_new_map() iterates mdsc->sessions[] and for each active session
  drops mdsc->mutex to perform per-…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ceph: fix UAF in check_new_map() on session freed during unlock

  check_new_map() iterates mdsc->sessions[] and for each active session
  drops mdsc->mutex to perform per-…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-364
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 2f2dc053404febedc9c273452d9d518fb31fde72 <
    9646dfee880730aae4b379a4b8ee6c88ac735acd
  - >-
    Linux >= 2f2dc053404febedc9c273452d9d518fb31fde72 <
    21d5be092d947f8d83f76f7ebf3989e7e9230a98
  - >-
    Linux >= 2f2dc053404febedc9c273452d9d518fb31fde72 <
    ee611a7509554c4ca1f54f6aefe592fb1df7ea70
  - Linux 2.6.34
published: '2026-09-11'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:17:54.873'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89654'
references:
  - url: 'https://git.kernel.org/stable/c/21d5be092d947f8d83f76f7ebf3989e7e9230a98'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9646dfee880730aae4b379a4b8ee6c88ac735acd'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ee611a7509554c4ca1f54f6aefe592fb1df7ea70'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89654.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89654'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532045'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89654'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89654'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89654.mbox
  - url: 'https://git.kernel.org/stable/c/352a278d5a1965aae3f817ce5d24a67ee42d45d1'
  - url: 'https://git.kernel.org/stable/c/820871e9dbeecd2533c4c5f5d91878ceaf02324c'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00671
epssPercentile: 0.51833
scores:
  nvd: 9.8
  cna: 9.8
  vendor: 7
ingestedAt: '2026-09-14T15:23:07.473Z'
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T19:25:25.205939Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix UAF in check_new_map() on session freed during unlock

check_new_map() iterates mdsc->sessions[] and for each active session
drops mdsc->mutex to perform per-session operations.  The forced-close
path (rank removed from map) correctly takes a reference on s via
ceph_get_mds_session() before releasing mdsc->mutex, but three other
paths do not:

  Path A (address changed):  mutex_unlock → mutex_lock(&s->s_mutex)
  Path B (reconnect):        mutex_unlock → send_mds_reconnect(mdsc, s)
  Path C (active transition): mutex_unlock → mutex_lock(&s->s_mutex)

Without the extra reference, another thread can acquire mdsc->mutex
during the unlock window, call __unregister_session() which drops the
last reference on s, and free it.  The original thread then accesses
freed memory via s->s_mutex.

Fix by adding ceph_get_mds_session(s) before each mutex_unlock and
ceph_put_mds_session(s) after the corresponding mutex_lock, matching
the pattern already used in the forced-close path.

Race timeline (Path A):

  Thread A (check_new_map)             Thread B (another map update
    holds mdsc->mutex                      or session teardown)
  --------------------------           --------------------------
  s = mdsc->sessions[i]
  (refcount == 1, held only by
   sessions[] array)

  mutex_unlock(&mdsc->mutex)
                               --->    acquires mdsc->mutex
                                       __unregister_session(mdsc, s)
                                         sessions[i] = NULL
                                         ceph_put_mds_session(s)
                                           refcount: 1 -> 0
                                           kfree(s)  <--- freed!

  mutex_lock(&s->s_mutex)
  UAF on freed s->s_mutex

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89654.json)