{"id":"CVE-2026-89654","summary":"ceph: fix UAF in check_new_map() on session freed during unlock","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix UAF in check_new_map() on session freed during unlock\n\ncheck_new_map() iterates mdsc-\u003esessions[] and for each active session\ndrops mdsc-\u003emutex to perform per-session operations.  The forced-close\npath (rank removed from map) correctly takes a reference on s via\nceph_get_mds_session() before releasing mdsc-\u003emutex, but three other\npaths do not:\n\n  Path A (address changed):  mutex_unlock → mutex_lock(&s-\u003es_mutex)\n  Path B (reconnect):        mutex_unlock → send_mds_reconnect(mdsc, s)\n  Path C (active transition): mutex_unlock → mutex_lock(&s-\u003es_mutex)\n\nWithout the extra reference, another thread can acquire mdsc-\u003emutex\nduring the unlock window, call __unregister_session() which drops the\nlast reference on s, and free it.  The original thread then accesses\nfreed memory via s-\u003es_mutex.\n\nFix by adding ceph_get_mds_session(s) before each mutex_unlock and\nceph_put_mds_session(s) after the corresponding mutex_lock, matching\nthe pattern already used in the forced-close path.\n\nRace timeline (Path A):\n\n  Thread A (check_new_map)             Thread B (another map update\n    holds mdsc-\u003emutex                      or session teardown)\n  --------------------------           --------------------------\n  s = mdsc-\u003esessions[i]\n  (refcount == 1, held only by\n   sessions[] array)\n\n  mutex_unlock(&mdsc-\u003emutex)\n                               ---\u003e    acquires mdsc-\u003emutex\n                                       __unregister_session(mdsc, s)\n                                         sessions[i] = NULL\n                                         ceph_put_mds_session(s)\n                                           refcount: 1 -\u003e 0\n                                           kfree(s)  \u003c--- freed!\n\n  mutex_lock(&s-\u003es_mutex)\n  UAF on freed s-\u003es_mutex","modified":"2026-09-25T18:27:37.022366037Z","published":"2026-09-11T19:45:44.086Z","related":["openSUSE-SU-2026:11880-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89654.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/21d5be092d947f8d83f76f7ebf3989e7e9230a98"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ee611a7509554c4ca1f54f6aefe592fb1df7ea70"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89654.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89654"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"2f2dc053404febedc9c273452d9d518fb31fde72"},{"fixed":"21d5be092d947f8d83f76f7ebf3989e7e9230a98"},{"fixed":"ee611a7509554c4ca1f54f6aefe592fb1df7ea70"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-89654.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.34"},{"fixed":"7.2.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-89654.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}