CVE-2026-89654

A flaw was found in the Ceph file system component of the Linux kernel. A race condition exists in the check_new_map() function during session handling. This allows a local attacker to exploit a use-after-free vulnerability by freeing a session while another thread attempts to access it. This could lead to a denial of service or potentially arbitrary code execution.

A use after free race exists in the CephFS MDS client check_new_map path because the code can drop mdsc mutex while still using a ceph_mds_session pointer without taking an extra reference. During that unlock window another thread can unregister the same session, drop the last reference, and free the object, after which the original path may access freed memory through s_mutex or later session operations. For the CVSS the PR:N value is used for the paranoid network storage scenario because an attacker does not need local privileges on the victim if they can control or tamper with the relevant Ceph MDS or monitor driven session state. The attack is not expected to be Internet exposed in typical deployments and usually requires access to a Ceph storage cluster network or a compromised cluster endpoint. Impact is at least denial of service via kernel crash. In the worst case this UAF may allow confidentiality or integrity impact due to kernel memory corruption and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.