Junglewise Threat Intelligence

CVE-2026-89990: Linux kernel Ceph use-after-free in MDS access check

CVE-2026-89990 · Severity: critical · CVSS 9.8 · Published 2026-09-16

Executive brief

The Linux kernel's Ceph filesystem driver contains a race condition in its metadata server (MDS) access control check. When the MDS session reopens and updates its capability authorization array, a concurrent access check operation may read freed memory, causing a kernel crash and potential denial of service to systems using Ceph storage.

Technical details

This is a use-after-free vulnerability in the Ceph filesystem driver's ceph_mds_check_access() function in fs/ceph/mds_client.c. The root cause is a missing mutex lock around array traversal: MDS session OPEN handling replaces mdsc->s_cap_auths under mdsc->mutex protection, but ceph_mds_check_access() reads this same array without holding the mutex. A concurrent session reopen can free the array while it is being inspected by another thread, causing a kernel oops with invalid memory access. The attack requires network access to a Ceph MDS server and can be triggered via concurrent MDS operations. The fix adds mutex_lock/mutex_unlock calls around the array traversal in ceph_mds_check_access().

Affected products

  • Linux Linux kernel before fix in 6.18.45 and other stable branches (affects Linux 4.x through 6.x)

Timeline

  • 2026-09-16: disclosed: Published on NVD
  • 2026-09-02: patched: Patch committed upstream
  • 2026-09-14: patched: Backported to stable branches including 6.18.45

References

Related threats