CVE-2026-89655

A flaw was found in the Linux kernel's Ceph file system component. A race condition exists in the __kick_flushing_caps() function during the handling of capability messages. This allows a separate process to free a data structure (cf entry) while __kick_flushing_caps() is still iterating over it. This use-after-free (UAF) vulnerability can lead to system instability, a denial of service (DoS), or potentially privilege escalation for a local attacker.

A use-after-free can occur in the CephFS client because __kick_flushing_caps iterates ci i_cap_flush_list and drops i_ceph_lock while sending cap messages. During this unlock window, a fast FLUSH_ACK from the MDS can let handle_cap_flush_ack detach and free the same ceph_cap_flush entry, after which the original loop may dereference the freed list node when advancing to the next entry. For the CVSS the PR:N is used in the paranoid network based interpretation because the attacker does not need local privileges on the victim if they control or compromise the Ceph MDS endpoint or can otherwise influence MDS replies. The attack is network reachable only in deployments where the victim CephFS client communicates with an attacker controlled or compromised MDS, and it is not a generic Internet exposed service on most systems. Impact is at least denial of service via kernel crash, and in the paranoid assessment it may allow confidentiality or integrity impact because the bug class is kernel use-after-free rather than a simple NULL dereference.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.