Linux kernel CephFS client: use-after-free when an MDS session reopens during an access check

Impact

MDS session OPEN handling swaps out mdsc->s_cap_auths under mdsc->mutex and frees the old array and its strings, while ceph_mds_check_access() walks that array without taking the mutex. A session reopen concurrent with any path-open on the mount frees the array under the reader, producing the oops shown in the commit message and, in the general case, a use-after-free an attacker could try to shape into memory corruption. On GPU nodes this matters where CephFS is the shared dataset or checkpoint filesystem mounted in-kernel on every worker: the fault lands in the host kernel, so a training node panics rather than a single job failing, and any node holding the mount is affected. The NVD score of 9.8 with AV:N is the blanket value the kernel CNA applies; the trigger here is a local filesystem operation racing an MDS session reopen, not a remote request.

Who can reach it

Local - any user or container that can open paths on a kernel CephFS mount, racing an MDS session reopen (which a flapping or hostile MDS can drive). No special privilege beyond access to the mount; no authentication to the node beyond a shell or pod on it.

What to do

Take the stable-kernel update carrying the fix (the four git.kernel.org commits listed) from your distribution and reboot each node that mounts CephFS; there is no runtime mitigation short of unmounting CephFS or moving to the FUSE client. Drain and reboot per node - the fix is in the ceph module path in the running kernel, so a module reload would require unmounting every CephFS mount first. No fixed distribution version is stated in the record.

References

Related entries

• Linux kernel NFSD: client use-after-free when the laundromat reaps a blocked lockCVE-2026-90036 · Linux kernel NFSD (blocked-lock laundromat reaping)Critical
• Linux kernel NFSD: client use-after-free when the laundromat reaps close_lru open ownersCVE-2026-90037 · Linux kernel NFSD (close_lru laundromat reaping)Critical
• Linux kernel NFSD: client use-after-free when an export is removed during client expiryCVE-2026-90038 · Linux kernel NFSD (nfsd4_revoke_export_states, export unlock path)Critical
• Linux kernel CephFS client: oops decrypting filenames from vmalloc() message buffersCVE-2026-90042 · Linux kernel CephFS client (ceph_fname_to_usr, fscrypt filename decryption)Critical
• Linux kernel (drivers/pci/controller/dwc): A PCIe BAR window can end up larger than the memory actually backing it, soCVE-2024-58006 · Linux kernel (drivers/pci/controller/dwc)Critical
• Linux kernel (net/core, net/tls): The bitmap that marks sk_msg scatterlist entries as externally owned was not carriedCVE-2026-63830 · Linux kernel (net/core, net/tls)Critical