Executive brief
The Linux kernel's Ceph filesystem driver contains a race condition in its metadata server (MDS) access control check. When the MDS session reopens and updates its capability authorization array, a concurrent access check operation may read freed memory, causing a kernel crash and potential denial of service to systems using Ceph storage.
Technical details
This is a use-after-free vulnerability in the Ceph filesystem driver's ceph_mds_check_access() function in fs/ceph/mds_client.c. The root cause is a missing mutex lock around array traversal: MDS session OPEN handling replaces mdsc->s_cap_auths under mdsc->mutex protection, but ceph_mds_check_access() reads this same array without holding the mutex. A concurrent session reopen can free the array while it is being inspected by another thread, causing a kernel oops with invalid memory access. The attack requires network access to a Ceph MDS server and can be triggered via concurrent MDS operations. The fix adds mutex_lock/mutex_unlock calls around the array traversal in ceph_mds_check_access().
Affected products
- Linux Linux kernel before fix in 6.18.45 and other stable branches (affects Linux 4.x through 6.x)
Timeline
- 2026-09-16: disclosed: Published on NVD
- 2026-09-02: patched: Patch committed upstream
- 2026-09-14: patched: Backported to stable branches including 6.18.45