CVE-2026-89655

The Linux kernel's Ceph filesystem client contains a use-after-free in __kick_flushing_caps(): it iterates the inode's cap-flush list using list_for_each_entry() while dropping i_ceph_lock to send cap messages to the MDS. During that unlock window, a fast FLUSH_ACK from the metadata server lets handle_cap_flush_ack() free the very cap-flush entry the loop is about to dereference, corrupting freed kernel memory — a timing-dependent race that a malicious or compromised MDS could deliberately trigger by responding immediately. Successful exploitation most plausibly crashes the client kernel (denial of service), though memory corruption in kernel context carries broader risk and the flaw is scored CVSS 3.1 9.8 (C:H/I:H/A:H). Affected systems are hosts mounting CephFS with kernel builds containing the vulnerable iteration code; the CVE record does not enumerate specific version ranges. There is no known public proof of concept, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported; the upstream fix saves the next list pointer under the lock before reusing it.

What to do: Patch first: install kernel updates from your distribution once they include the fs/ceph fix that saves the next list pointer under i_ceph_lock. If patching is delayed on CephFS client hosts, consider remounting filesystems with the userspace ceph-fuse client, which does not exercise the vulnerable kernel path. Monitor dmesg on CephFS-mounting hosts for ceph-related oopses or panics, especially under heavy metadata write load or after MDS leadership changes, and treat any unexplained crashes as possible indicators.