Linux CephFS client: use-after-free on an MDS session freed while check_new_map drops mdsc->mutex

Impact

check_new_map() walks mdsc->sessions[] and drops mdsc->mutex for per-session work. The forced-close path takes a session reference first, but three other paths - address change, reconnect, and the active transition - do not. Another thread that acquires mdsc->mutex in that window can call __unregister_session(), drop the last reference and free the session; the original thread then locks s->s_mutex on freed memory. This is a race in ordinary cluster churn - an MDS moving address, a reconnect, a rank going active - not something a tenant steers. On a GPU node with a kernel CephFS mount the outcome is a kernel crash and the loss of any resident job.

Who can reach it

No tenant path. Requires MDS map churn on the storage cluster and a concurrent session teardown on the client; influencing the timing means influencing the Ceph monitors or the storage network.

What to do

Update to a stable kernel carrying the fix (two backport commits linked on the record) and drain and reboot each node with a kernel CephFS mount - the client module cannot be replaced under a live mount. Batch with the other ceph fixes published the same day. No configuration change avoids the race.

References

Related entries

• Linux CephFS client: use-after-free when a cap-flush entry is freed by a fast FLUSH_ACK mid-iterationCVE-2026-89655 · Linux kernel CephFS client (__kick_flushing_caps, cap flush list iteration)Unscored
• Linux libceph: malformed CRUSH map aliases bucket workspaces and overflows the permutation bufferCVE-2026-89656 · Linux kernel libceph (crush_decode, bucket id vs array slot validation)Unscored
• Linux libceph: malformed OSD sparse-read reply advances the message cursor past the request buffer and panicsCVE-2026-89657 · Linux kernel libceph (osd_sparse_read, sparse extent map validation)Unscored
• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical
• Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the hostCVE-2026-48751 · Incus (instance snapshots ignore restricted.containers.lowlevel)Critical
• VMware ESXi (OpenSLP): Use-after-free in OpenSLP on port 427 - unauthenticated remote code execution on the hypervisorCVE-2020-3992 · VMware ESXi (OpenSLP)Critical