Linux CephFS client: use-after-free when a cap-flush entry is freed by a fast FLUSH_ACK mid-iteration

Impact

__kick_flushing_caps() iterates ci->i_cap_flush_list with list_for_each_entry() but drops i_ceph_lock to send each cap message. If the MDS answers with FLUSH_ACK quickly enough, handle_cap_flush_ack() detaches the entry and frees it outside any lock; the loop macro then dereferences cf->i_list.next on freed memory. The window is opened by the client's own send, so it needs no attacker - a responsive MDS under load is enough. On a GPU node with a kernel CephFS mount this is an unplanned node crash during normal filesystem writeback, which is exactly the kind of failure that costs a long-running training job. The fix converts the loop to save the next pointer under i_ceph_lock before dropping it.

Who can reach it

No authentication or tenant access needed to trigger - it is a timing race between the client's cap flush and the MDS ack. An attacker controlling the MDS could make fast acks more likely, but ordinary cluster latency suffices.

What to do

Update to a stable kernel carrying the fix (four backport commits linked on the record); drain and reboot each node holding a kernel CephFS mount, since the client cannot be reloaded under a live mount. Batch with the other ceph fixes from the same day. No configuration change avoids it.

References

Related entries

• Linux libceph: malformed CRUSH map aliases bucket workspaces and overflows the permutation bufferCVE-2026-89656 · Linux kernel libceph (crush_decode, bucket id vs array slot validation)Unscored
• Linux libceph: malformed OSD sparse-read reply advances the message cursor past the request buffer and panicsCVE-2026-89657 · Linux kernel libceph (osd_sparse_read, sparse extent map validation)Unscored
• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical
• Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the hostCVE-2026-48751 · Incus (instance snapshots ignore restricted.containers.lowlevel)Critical
• VMware ESXi (OpenSLP): Use-after-free in OpenSLP on port 427 - unauthenticated remote code execution on the hypervisorCVE-2020-3992 · VMware ESXi (OpenSLP)Critical
• Linux kernel mlx5_core kTLS RX offload: TLS RX resync list corruption: entries are moved by the resync handlerCVE-2021-47215 · Linux kernel mlx5_core kTLS RX offloadCritical