CVE-2026-89990

CVE-2026-89990 is a use-after-free in the Linux kernel's Ceph filesystem (CephFS) client: ceph_mds_check_access() walks the mdsc->s_cap_auths array without holding mdsc->mutex, while MDS session OPEN handling can replace that array and free the old array and its strings under the same mutex. The flaw is triggered when an MDS session is reopened concurrently with a process opening files on a CephFS mount; the fix commit's crash trace shows a php-cgi process faulting in ceph_atomic_open via path_openat after the array was freed beneath it. The demonstrated impact is a kernel oops (denial of service), and as a kernel-space use-after-free it may be exploitable further, consistent with the critical 9.8 CVSS score. Any Linux host mounting CephFS with a kernel containing the vulnerable access-check code is affected. No public proof-of-concept or confirmed malicious exploitation is known and the flaw is not in CISA KEV; it is fixed by a mainline kernel commit pending vendor backports.

What to do: Patch kernels on hosts that mount CephFS (verify with 'mount -t ceph') as soon as a fixed mainline kernel or vendor backport is available, prioritizing multi-user systems such as web servers running php-cgi where local processes can race session reopens. Until patched, restrict untrusted local access to CephFS-mounted hosts or unmount CephFS, and be aware that MDS failover/session-reopen events can trigger the race.