Riskcovery

CVE-2026-89990

ceph: lock mutex in ceph_mds_check_access()

State
Published
Severity
9.8 Critical
Published
Sep 16, 2026
Updated
Oct 19, 2026
Reserved
Sep 11, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ceph: lock mutex in ceph_mds_check_access()

MDS session OPEN handling replaces mdsc->s_cap_auths under mdsc->mutex, freeing the previous array and its strings.

ceph_mds_check_access() traverses this array without holding the mutex. A concurrent session reopen can therefore free the array while it is being inspected, resulting in a use-after-free like this:

Unable to handle kernel paging request at virtual address 003aaad64b2c8bb9 [...] Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 56 UID: 2953037534 PID: 1253231 Comm: php-cgi8.4 Not tainted 6.18.45-i2-ampere #1146 NONE [..] pc : ceph_mds_check_access+0xd4/0x550 lr : ceph_mds_check_access+0xc8/0x550 [...] Call trace: ceph_mds_check_access+0xd4/0x550 (P) ceph_atomic_open+0x138/0xbe8 path_openat+0xa24/0xfa8 do_filp_open+0x94/0x158 do_sys_openat2+0x88/0xf8

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 596afb0b8933ba6ed7227adcc538db26feb25c74 to before 729c1ff670ece6f3d4b1738365a0b2f90d487523Affected
  • 596afb0b8933ba6ed7227adcc538db26feb25c74 to before ca5bfea2045ef2eb3305cf2a9d8da549b76c37d3Affected
  • 596afb0b8933ba6ed7227adcc538db26feb25c74 to before df1a97d5313fccadb08390306d49b194fb027392Affected
  • 596afb0b8933ba6ed7227adcc538db26feb25c74 to before a61c6ae1dae2611082b831b4aaa780878099c012Affected
LinuxLinux
  • 6.10Affected
  • before 6.10Not affected
  • 6.12.110 through 6.12.*Not affected
  • 6.18.51 through 6.18.*Not affected
  • 7.2.5 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.