CVE-2026-89654: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-89654 is a use-after-free (UAF) vulnerability in the Linux kernel's Ceph filesystem subsystem, specifically within the check_new_map() function. The flaw arises from improper reference counting during MDS (Metadata Server) session management, allowing a race condition that can lead to local code execution with kernel privileges. It affects Linux kernel versions prior to 7.2.4 (git commits before 21d5be092d94 and ee611a750955), and was disclosed on September 11, 2026. The CVSS category is estimated as Medium (Red Hat CVE, Red Hat Bugzilla).

The root cause is a use-after-free condition (CWE-416) combined with a race condition (CWE-364) in check_new_map(), which iterates over mdsc->sessions[] and temporarily releases mdsc->mutex to perform per-session operations. Three code paths — Path A (address changed), Path B (reconnect), and Path C (active transition) — fail to acquire an extra reference on the session object (s) via ceph_get_mds_session() before releasing the lock. During the unlock window, a concurrent thread can acquire mdsc->mutex, call __unregister_session(), drop the last reference on s, and free it via kfree(s). The original thread then dereferences the freed s->s_mutex, resulting in a UAF. The fix adds ceph_get_mds_session(s) before each mutex_unlock and ceph_put_mds_session(s) after the corresponding mutex_lock, mirroring the pattern already used in the forced-close path (Red Hat Bugzilla).

Successful exploitation allows a local attacker to trigger arbitrary code execution at the kernel privilege level by racing the mutex unlock window to free a session object while another kernel thread still holds a pointer to it. This can result in full kernel compromise, enabling privilege escalation, bypassing security boundaries, and potentially destabilizing the system (denial of service via kernel panic). Systems running Ceph-backed filesystems (e.g., CephFS mounts) are at elevated risk, particularly in multi-tenant or shared infrastructure environments (Red Hat CVE, Red Hat Bugzilla).

There is currently no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Red Hat CVE). Exploitation requires local access and the ability to trigger Ceph MDS map updates or session teardown events, making it a lower-immediacy threat compared to remotely exploitable vulnerabilities. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no EPSS score data is currently available. The attack type is classified as local code execution.

1. Gain local access: Obtain a local user account on a Linux system with a CephFS filesystem mounted and active MDS sessions.
2. Trigger concurrent map updates or session teardown: Initiate operations that cause check_new_map() to iterate MDS sessions and release mdsc->mutex — for example, by inducing MDS rank changes, address changes, or reconnect events through Ceph cluster manipulation.
3. Race the unlock window: From a second thread or process, acquire mdsc->mutex during the brief window when check_new_map() has released it (after Path A, B, or C unlock), then call or trigger __unregister_session() to drop the last reference on the session object s and free it.
4. Trigger UAF: The original check_new_map() thread resumes and accesses s->s_mutex (or passes s to send_mds_reconnect()), now pointing to freed memory, resulting in a use-after-free.
5. Achieve kernel code execution: Leverage the UAF to corrupt kernel memory structures or redirect execution flow, potentially escalating privileges to root (Red Hat Bugzilla).

• Logs: Kernel logs (dmesg, /var/log/kern.log) showing KASAN (Kernel Address Sanitizer) reports referencing check_new_map(), __unregister_session(), or ceph_put_mds_session() with use-after-free or invalid memory access errors.
• Logs: Unexpected kernel panics or oops messages involving Ceph filesystem (ceph) module stack traces.
• Process: Unusual local processes attempting to manipulate Ceph MDS sessions or trigger rapid session teardown/reconnect cycles.
• File System: Unexpected privilege escalation artifacts (new SUID binaries, modified /etc/passwd, new root-owned cron jobs) following Ceph-related kernel errors.

Apply the Linux kernel patch that introduces proper reference counting in check_new_map() by adding ceph_get_mds_session(s) before each mutex_unlock and ceph_put_mds_session(s) after the corresponding mutex_lock for Paths A, B, and C. The fix is included in kernel versions 7.2.4 and later (git commits 21d5be092d94 and ee611a750955). As a short-term workaround where patching is not immediately possible, consider unmounting CephFS filesystems on sensitive systems or restricting local user access to systems with active Ceph MDS sessions (Red Hat CVE, Red Hat Bugzilla).