Executive brief
The Linux kernel's Ceph network file system client contains a use-after-free vulnerability in session management. An attacker could trigger a race condition during map updates that causes the kernel to access freed memory, potentially leading to system crashes, privilege escalation, or remote code execution on systems using Ceph storage.
Technical details
The vulnerability is a use-after-free (UAF) in the check_new_map() function of the ceph driver. The root cause is a race condition: check_new_map() iterates over active MDS sessions and temporarily releases the mdsc->mutex lock to perform per-session operations. Three code paths (address change, reconnect, and active transition) release this lock without taking a reference on the session object. A concurrent thread can acquire the lock, unregister the session (dropping the last reference), and free the memory while the original thread still holds a pointer to it. When the original thread reacquires the lock, it accesses the freed session structure. The fix adds ceph_get_mds_session() calls before unlocking to maintain a reference, matching the pattern already used in the forced-close path. The attack requires the ability to trigger Ceph map updates or session state changes, typically available to network-adjacent or local attackers.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-11: disclosed