Linux CephFS client: use-after-free on an MDS session freed while check_new_map drops mdsc->mutex

UnscoredCVE-2026-89654Kernel, userspace & hypervisorcurated

Impact

check_new_map() walks mdsc->sessions[] and drops mdsc->mutex for per-session work. The forced-close path takes a session reference first, but three other paths - address change, reconnect, and the active transition - do not. Another thread that acquires mdsc->mutex in that window can call __unregister_session(), drop the last reference and free the session; the original thread then locks s->s_mutex on freed memory. This is a race in ordinary cluster churn - an MDS moving address, a reconnect, a rank going active - not something a tenant steers. On a GPU node with a kernel CephFS mount the outcome is a kernel crash and the loss of any resident job.

Who can reach it

No tenant path. Requires MDS map churn on the storage cluster and a concurrent session teardown on the client; influencing the timing means influencing the Ceph monitors or the storage network.

What to do

Update to a stable kernel carrying the fix (two backport commits linked on the record) and drain and reboot each node with a kernel CephFS mount - the client module cannot be replaced under a live mount. Batch with the other ceph fixes published the same day. No configuration change avoids the race.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-89654 https://git.kernel.org/stable/c/21d5be092d947f8d83f76f7ebf3989e7e9230a98 https://git.kernel.org/stable/c/ee611a7509554c4ca1f54f6aefe592fb1df7ea70

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.