CVE-2026-89990

A flaw was found in the Ceph filesystem module of the Linux kernel. A local attacker could trigger a use-after-free vulnerability in the ceph_mds_check_access() function. This occurs when a concurrent session reopens and frees an array while it is still being accessed, leading to a system crash and resulting in a Denial of Service (DoS).

A race in CephFS authorization handling allows MDS session OPEN processing to replace and free mdsc s_cap_auths while ceph_mds_check_access is traversing the same array and its strings. This produces a confirmed use after free read during a filesystem open operation and can cause a kernel Oops and denial of service. For the CVSS the PR:L is used because an unprivileged local process with access to the mounted CephFS namespace can invoke the affected access check. AC:H is used because exploitation requires overlap with an MDS session reopen. The issue is not directly reachable through arbitrary unauthenticated network traffic, although reconnect or MDS session activity supplies the concurrent event needed for the race. Impact is at least a local denial of service via kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.