Look up another CVE · open CVE-2026-89654 in the interactive tracker

CVE-2026-89654

ceph: fix UAF in check_new_map() on session freed during unlock

9.8 EPSS 0.6% AV:N

Published 2026-09-11 (37 days ago) by the Linux kernel CNA. Subsystem fs/ceph. Debian urgency: not yet assigned.

What to do, per Debian release

Debian's own status for CVE-2026-89654 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	vulnerable	6.1.190-1	No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication.
Debian 13trixie	vulnerable	6.12.113-1	No fix published anywhere yet, neither in Debian nor upstream for the series trixie tracks. Watch the Debian tracker page for this CVE. Advisories for trixie have historically landed a median of 11 days after publication.
Debian 14forky	fixed	7.2.6-1	Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.2.6-1	Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

check_new_map() iterates mdsc->sessions[] and for each active session drops mdsc->mutex to perform per-session operations. The forced-close path (rank removed from map) correctly takes a reference on s via ceph_get_mds_session() before releasing mdsc->mutex, but three other paths do not: Path A (address changed): mutex_unlock → mutex_lock(&s->s_mutex) Path B (reconnect): mutex_unlock → send_mds_reconnect(mdsc, s) Path C (active transition): mutex_unlock → mutex_lock(&s->s_mutex) Without the extra reference, another thread can acquire mdsc->mutex during the unlock window, call __unregister_session() which drops the last reference on s, and free it. The original thread then accesses freed memory via s->s_mutex. Fix by adding ceph_get_mds_session(s) before each mutex_unlock and ceph_put_mds_session(s) after the corresponding mutex_lock, matching the pattern already used in the forced-close path. Race timeline (Path A): Thread A (check_new_map) Thread B (another map update holds mdsc->mutex or session teardown) -------------------------- -------------------------- s = mdsc->sessions[i] (refcount == 1, held only by sessions[] array) mutex_unlock(&mdsc->mutex) ---> acquires mdsc->mutex __unregister_session(mdsc, s) sessions[i] = NULL ceph_put_mds_session(s) refcount: 1 -> 0 kfree(s) <--- freed! mutex_lock(&s->s_mutex) UAF on freed s->s_mutex

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

fs/ceph/mds_client.c

What this is: CEPH DISTRIBUTED FILE SYSTEM CLIENT (CEPH)MAINTAINERS section matched on fs/ceph/ · ceph-devel@vger.kernel.org · Supported
Kernel module: ceph

Check it on the machine

grep -w CONFIG_CEPH_FS /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w ceph

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.

bookworm, trixie, forky, sidm

m: a loadable module on every flavour - check lsmod, can be blacklisted

Build switch: CONFIG_CEPH_FS

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-09-11 (37 days ago)source
CVSS: 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it
Attack vector: network (AV:N)source
EPSS: 0.65%, higher than 50.1% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: not yet assignedsource
Subsystem: fs/ceph

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
2.6.34	6.18.57	9646dfee8807
2.6.34	7.2.4	21d5be092d94
2.6.34	7.3	ee611a750955

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network: check_new_map() runs from ceph_mdsc_handle_mdsmap() on CEPH_MSG_MDS_MAP received over TCP from a monitor (extra_mon_dispatch) or MDS (mds_dispatch); a malicious or compromised Ceph peer reaches the UAF on already-mounted CephFS clients without a local syscall.
AC:LAttack complexity, low: A cluster attacker controls both race sides: one TCP session delivers an MDS map that drops mdsc->mutex in the address-change, reconnect, or active-transition paths, while another concurrently sends a rank-removing map, CEPH_SESSION_CLOSE, or connection reset into __unregister_session(); Path B's send_mds_reconnect() GFP_NOFS work makes the window retryable.
PR:NPrivileges required, none: The attacker acts as the remote MON/MDS peer, or an on-path attacker on a legacy unsigned msgr session, and needs no UID, capability, or init-namespace root on the victim; any kernel CephFS client already connected to that cluster is exposed.
UI:NUser interaction, none: Once CephFS is mounted, as is standard on Rook/Kubernetes, HPC, and cloud nodes, MDS-map updates and session teardown messages are processed automatically in ceph-msgr kworker context with no further victim mount, open, or interactive action.
S:UScope, unchanged: The session-object use-after-free corrupts kernel heap on the client host within the same security authority and does not inherently cross a VM, IOMMU, or sandbox boundary.
C:HConfidentiality impact, high: Use-after-free of struct ceph_mds_session allows reclaim of the freed object so later reads of session fields, embedded connection state, and cap lists can disclose arbitrary kernel memory, matching CNA guidance that UAFs enable high confidentiality impact.
I:HIntegrity impact, high: The same reclaimed session is written (s_mutex, s_state, ceph_con_close, reconnect and cap-kick paths), enabling heap corruption and hijack of the embedded ceph_connection ops for arbitrary kernel writes and control-flow hijacking.
A:HAvailability impact, high: Locking or dereferencing the freed session mutex and fields causes a kernel oops or panic, and the attacker can repeat map updates and session teardown to trigger the crash.