CVE-2026-89990 - ceph: lock mutex in ceph_mds_check_access()

Back Back to CVE browser

CRITICAL

ceph: lock mutex in ceph_mds_check_access()

Published Sep 16, 2026

9.8

CRITICAL

CVSS 3.1

EPSS 0.65%

Description

MDS session OPEN handling replaces mdsc->s_cap_auths under mdsc->mutex, freeing the previous array and its strings.

ceph_mds_check_access() traverses this array without holding the mutex. A concurrent session reopen can therefore free the array while it is being inspected, resulting in a use-after-free like this:

Unable to handle kernel paging request at virtual address 003aaad64b2c8bb9 [...] Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 56 UID: 2953037534 PID: 1253231 Comm: php-cgi8.4 Not tainted 6.18.45-i2-ampere #1146 NONE [..] pc : ceph_mds_check_access+0xd4/0x550 lr : ceph_mds_check_access+0xc8/0x550 [...] Call trace: ceph_mds_check_access+0xd4/0x550 (P) ceph_atomic_open+0x138/0xbe8 path_openat+0xa24/0xfa8 do_filp_open+0x94/0x158 do_sys_openat2+0x88/0xf8

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
affected
- Version
  6.10
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <6.10
- Version
  6.12.110
  Status
  unaffected
  Constraints
  <=6.12.*
- Version
  6.18.51
  Status
  unaffected
  Constraints
  <=6.18.*
- Version
  7.2.5
  Status
  unaffected
  Constraints
  <=7.2.*
- Version
  7.3-rc2
  Status
  unaffected
  Constraints
  <=*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
	affected
	affected
	affected
	affected

Linux

affected

Version	Status	Constraints
6.10	affected	-
0	unaffected	<6.10
6.12.110	unaffected	<=6.12.*
6.18.51	unaffected	<=6.18.*
7.2.5	unaffected	<=7.2.*
7.3-rc2	unaffected	<=*

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (5)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-80598		Advisory
https://git.kernel.org/stable/c/729c1ff670ece6f3d4b1738365a0b2f90d487523
https://git.kernel.org/stable/c/a61c6ae1dae2611082b831b4aaa780878099c012
https://git.kernel.org/stable/c/ca5bfea2045ef2eb3305cf2a9d8da549b76c37d3
https://git.kernel.org/stable/c/df1a97d5313fccadb08390306d49b194fb027392