CVE-2026-89654

The Linux kernel's Ceph filesystem client contains a use-after-free in check_new_map(), which iterates the MDS session array and temporarily drops the mdsc->mutex to perform per-session operations. In three code paths (MDS address change, reconnect, and active-state transition), no reference is taken on the session before the mutex is released, so a concurrent thread can unregister and free the session during the unlock window, and the original thread then touches freed memory via s->s_mutex. The flaw is triggered by concurrent MDS map updates or session teardown, which an attacker influencing the Ceph metadata server map (e.g., a compromised or malicious MDS, or a raced cluster event) could drive, potentially leading to kernel memory corruption with confidentiality, integrity, and availability impact (CVSS 9.8). Only systems running kernels with the Ceph filesystem client enabled and mounting CephFS are exposed; this requires CONFIG_CEPH_FS and an active CephFS mount against an MDS cluster. No public proof of concept is known and the issue is not listed in CISA's KEV, so exploitation is not observed in the wild.

What to do: Apply a kernel update containing the ceph check_new_map() fix (which adds ceph_get_mds_session()/ceph_put_mds_session() around the three unlocked paths) as soon as your distribution ships it. As an interim mitigation, unmount CephFS kernel-client mounts and use the userspace ceph-fuse client instead, and restrict kernel CephFS mounts to trusted, well-administered MDS clusters. Check whether hosts run kernels with CONFIG_CEPH_FS enabled and have active CephFS mounts, and monitor for kernel oopses or crashes in check_new_map()/session teardown on those systems.