CVE-2026-89654

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in check_new_map() on session freed during unlock check_new_map() iterates mdsc->sessions[] and for each active session drops mdsc->mutex to perform per-session operations. The forced-close path (rank removed from map) correctly takes a reference on s via ceph_get_mds_session() before releasing mdsc->mutex, but three other paths do not: Path A (address changed): mutex_unlock → mutex_lock(&s->s_mutex) Path B (reconnect): mutex_unlock → send_mds_reconnect(mdsc, s) Path C (active transition): mutex_unlock → mutex_lock(&s->s_mutex) Without the extra reference, another thread can acquire mdsc->mutex during the unlock window, call __unregister_session() which drops the last reference on s, and free it. The original thread then accesses freed memory via s->s_mutex. Fix by adding ceph_get_mds_session(s) before each mutex_unlock and ceph_put_mds_session(s) after the corresponding mutex_lock, matching the pattern already used in the forced-close path. Race timeline (Path A): Thread A (check_new_map) Thread B (another map update holds mdsc->mutex or session teardown) -------------------------- -------------------------- s = mdsc->sessions[i] (refcount == 1, held only by sessions[] array) mutex_unlock(&mdsc->mutex) ---> acquires mdsc->mutex __unregister_session(mdsc, s) sessions[i] = NULL ceph_put_mds_session(s) refcount: 1 -> 0 kfree(s) <--- freed! mutex_lock(&s->s_mutex) UAF on freed s->s_mutex

• https://git.kernel.org/stable/c/21d5be092d947f8d83f76f7ebf3989e7e9230a98
• https://git.kernel.org/stable/c/ee611a7509554c4ca1f54f6aefe592fb1df7ea70

Published

Sep 11, 2026

Last Modified

Sep 13, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-89649In the Linux kernel, the following vulnerability has been re…9.1
• CVE-2026-8965Information disclosure in the DOM: Security component. This …7.5
• CVE-2026-89650In the Linux kernel, the following vulnerability has been re…9.1
• CVE-2026-89651In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-89652In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-89653In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-89655In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-89656In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-89657In the Linux kernel, the following vulnerability has been re…7.5
• CVE-2026-89658In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-89659In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-8966Information disclosure in the IP Protection component. This …7.5