---
id: CVE-2026-89655
title: 'ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock

  list_for_each_entry() iterates ci->i_cap_flush_list but drops
  i_ceph_lock to send cap messages.…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-366
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 <
    091137821e1fc88f37e15201abf055c9494ddc61
  - >-
    Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 <
    01542430081014d80fc9e70e92d6647432ddb7fc
  - >-
    Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 <
    23eb34a53a53cb1a6dab1eeee830633207ac158d
  - >-
    Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 <
    19f16f04c2b014a7dd214dc1e42557d8530b16f3
  - >-
    Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 <
    2701431aa3cc8b23efe6890182e7b04f5e76fab5
  - >-
    Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 <
    fe46746087b5b9c5bb2d022df6c7819218494ced
  - >-
    Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 <
    2dba24dcd5050be4b7b119e6f0b01f62203b5d26
  - >-
    Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 <
    7af4c4f01305b0935adf6d4301b1ec407025485d
  - Linux 4.8
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T19:25:27.776156Z'
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:50:26.879Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89655'
references:
  - url: 'https://git.kernel.org/stable/c/091137821e1fc88f37e15201abf055c9494ddc61'
  - url: 'https://git.kernel.org/stable/c/01542430081014d80fc9e70e92d6647432ddb7fc'
  - url: 'https://git.kernel.org/stable/c/23eb34a53a53cb1a6dab1eeee830633207ac158d'
  - url: 'https://git.kernel.org/stable/c/19f16f04c2b014a7dd214dc1e42557d8530b16f3'
  - url: 'https://git.kernel.org/stable/c/2701431aa3cc8b23efe6890182e7b04f5e76fab5'
  - url: 'https://git.kernel.org/stable/c/fe46746087b5b9c5bb2d022df6c7819218494ced'
  - url: 'https://git.kernel.org/stable/c/2dba24dcd5050be4b7b119e6f0b01f62203b5d26'
  - url: 'https://git.kernel.org/stable/c/7af4c4f01305b0935adf6d4301b1ec407025485d'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89655.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89655'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532127'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89655'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89655'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89655.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00714
epssPercentile: 0.53476
scores:
  cna: 9.8
  vendor: 7
ingestedAt: '2026-09-14T15:23:07.450Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock

list_for_each_entry() iterates ci->i_cap_flush_list but drops
i_ceph_lock to send cap messages.  During the unlock window,
handle_cap_flush_ack() can acquire i_ceph_lock, detach cf entries
with tid <= flush_tid from the list, release i_ceph_lock, and free
them via ceph_free_cap_flush() outside any lock.  When the original
thread reacquires i_ceph_lock and the for-loop macro advances via
cf = list_next_entry(cf, i_list), it dereferences cf->i_list.next
on freed memory.

The race timeline:

  __kick_flushing_caps()              handle_cap_flush_ack()
  -----------------------             -----------------------
  holds i_ceph_lock        <---
  iterates to cf (tid=10)
  prepares FLUSH message
  drops i_ceph_lock        <---
  __send_cap() ── FLUSH(tid=10)
	                              MDS sends FLUSH_ACK(tid=10)
                           --->       acquires i_ceph_lock
                                      cf->tid(10) <= flush_tid(10),
                                      detaches cf from i_cap_flush_list
                                      drops i_ceph_lock
                                      ceph_free_cap_flush(cf) <- frees it!
  acquires i_ceph_lock     <---
  for-loop advances:
    cf = list_next_entry(cf, i_list)
      -- UAF on freed cf->i_list.next

The cf was just sent by __kick_flushing_caps itself via __send_cap().
The MDS may respond with FLUSH_ACK quickly enough that
handle_cap_flush_ack() frees cf before __kick_flushing_caps can
finish the iteration.

Fix by converting to a manual while loop: save the next pointer
under i_ceph_lock before dropping it, then use the saved pointer
after reacquiring, so the potentially-freed cf is never accessed again.

## Affected

- `Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 < 091137821e1fc88f37e15201abf055c9494ddc61`
- `Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 < 01542430081014d80fc9e70e92d6647432ddb7fc`
- `Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 < 23eb34a53a53cb1a6dab1eeee830633207ac158d`
- `Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 < 19f16f04c2b014a7dd214dc1e42557d8530b16f3`
- `Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 < 2701431aa3cc8b23efe6890182e7b04f5e76fab5`
- `Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 < fe46746087b5b9c5bb2d022df6c7819218494ced`
- `Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 < 2dba24dcd5050be4b7b119e6f0b01f62203b5d26`
- `Linux >= e4500b5e35c213e0f97be7cb69328c0877203a79 < 7af4c4f01305b0935adf6d4301b1ec407025485d`
- `Linux 4.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89655.json)