{"cve":"CVE-2026-89654","nvd":{"published":"2026-09-11T20:19:51.540","modified":"2026-10-21T13:20:18.900","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix UAF in check_new_map() on session freed during unlock\n\ncheck_new_map() iterates mdsc->sessions[] and for each active session\ndrops mdsc->mutex to perform per-session operations.  The forced-close\npath (rank removed from map) correctly takes a reference on s via\nceph_get_mds_session() before releasing mdsc->mutex, but three other\npaths do not:\n\n  Path A (address changed):  mutex_unlock → mutex_lock(&s->s_mutex)\n  Path B (reconnect):        mutex_unlock → send_mds_reconnect(mdsc, s)\n  Path C (active transition): mutex_unlock → mutex_lock(&s->s_mutex)\n\nWithout the extra reference, another thread can acquire mdsc->mutex\nduring the unlock window, call __unregister_session() which drops the\nlast reference on s, and free it.  The original thread then accesses\nfreed memory via s->s_mutex.\n\nFix by adding ceph_get_mds_session(s) before each mutex_unlock and\nceph_put_mds_session(s) after the corresponding mutex_lock, matching\nthe pattern already used in the forced-close path.\n\nRace timeline (Path A):\n\n  Thread A (check_new_map)             Thread B (another map update\n    holds mdsc->mutex                      or session teardown)\n  --------------------------           --------------------------\n  s = mdsc->sessions[i]\n  (refcount == 1, held only by\n   sessions[] array)\n\n  mutex_unlock(&mdsc->mutex)\n                               --->    acquires mdsc->mutex\n                                       __unregister_session(mdsc, s)\n                                         sessions[i] = NULL\n                                         ceph_put_mds_session(s)\n                                           refcount: 1 -> 0\n                                           kfree(s)  <--- freed!\n\n  mutex_lock(&s->s_mutex)\n  UAF on freed s->s_mutex","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":[],"references":["https://git.kernel.org/stable/c/21d5be092d947f8d83f76f7ebf3989e7e9230a98","https://git.kernel.org/stable/c/352a278d5a1965aae3f817ce5d24a67ee42d45d1","https://git.kernel.org/stable/c/820871e9dbeecd2533c4c5f5d91878ceaf02324c","https://git.kernel.org/stable/c/9646dfee880730aae4b379a4b8ee6c88ac735acd","https://git.kernel.org/stable/c/ee611a7509554c4ca1f54f6aefe592fb1df7ea70"],"products":[],"source":"nvd","synced_at":"2026-10-22T16:41:11.231219466+00:00"},"epss":{"cve":"CVE-2026-89654","score":0.00671,"percentile":0.51749,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}