From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5F61B58FD0C for ; Fri, 11 Sep 2026 20:00:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789156861; cv=none; b=dNhjxqTlnW56Cb7a11uTSVPxK686IUZ4hnUnutIqQDkODVr2tZY+aLapgs3LDvh28F1Mz4Sggtj0ucMBrF+MR4bGUJwqeHCMXu6nPriWmeYPMDVn2Jg/CJ67ArdFxq1v4Oaz7xY0zuTUT/wxngnk4VZmTjxkRf58P7t9lR1Sd2g= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789156861; c=relaxed/simple; bh=3uV0foHzawt/WuNxJk+dSMk7ZlZaz4dAE4CPOWR2qzs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=tO+a1Eiyz5GF6cuvOHDkINK5Hsuk+KZhWHF3y10PFnYprfzoGJZ3QUPOvE6gSCahUs6pMbGj+zMHkbQr/AbVKja3jeWZ66mpmmJoYd2v5Jg/8R00WOKwFVuMLUVXPTnlks7HYlh38fb2h1tCdxDI92vCIhhG3YkiBqHgTar/Q2s= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Kq3zinN3; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Kq3zinN3" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 641931F000FF; Fri, 11 Sep 2026 20:00:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789156857; bh=CsTrTJhQHcJnW5BnqHbhpBzoDDHOMzFbSkZ094LALrM=; h=From:To:Cc:Subject:Date:Reply-To; b=Kq3zinN3+nkRT6zpbbLf1T7PByoQYKEfkFoLCB5hlqPA8o/PTJpfRfSsihuCgJyuI lKXzEcAN0VblSTFzSo7ztu+WU2WQPhXJNiZoLuO9bZzPfBljO91KDQkuRqUWoV0RNJ jDVhXdoDe6m7sZD/mRo6ingw5kf0O5aslcidTrNQ= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-89654: ceph: fix UAF in check_new_map() on session freed during unlock Date: Fri, 11 Sep 2026 21:45:43 +0200 Message-ID: <2026091145-CVE-2026-89654-49e3@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3334; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=9RtD0s4igoux29TQfKbByrJ6KAX18T84FAyXBzf3Gps=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlLIivjQ69OuZFQ+HjW2klv1s9/dIRtX51Lpa5Xcuo6J aspdVMXd8SyMAgyMciKKbJ82cZzdH/FIUUvQ9vTMHNYmUCGMHBxCsBEtP8xLFjU9KnUz6vR89Pk vgd3ZVgP7tZ7U84wP2W/Mg93xcwZbxTdUmXm21exWMQsBQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in check_new_map() on session freed during unlock check_new_map() iterates mdsc->sessions[] and for each active session drops mdsc->mutex to perform per-session operations. The forced-close path (rank removed from map) correctly takes a reference on s via ceph_get_mds_session() before releasing mdsc->mutex, but three other paths do not: Path A (address changed): mutex_unlock → mutex_lock(&s->s_mutex) Path B (reconnect): mutex_unlock → send_mds_reconnect(mdsc, s) Path C (active transition): mutex_unlock → mutex_lock(&s->s_mutex) Without the extra reference, another thread can acquire mdsc->mutex during the unlock window, call __unregister_session() which drops the last reference on s, and free it. The original thread then accesses freed memory via s->s_mutex. Fix by adding ceph_get_mds_session(s) before each mutex_unlock and ceph_put_mds_session(s) after the corresponding mutex_lock, matching the pattern already used in the forced-close path. Race timeline (Path A): Thread A (check_new_map) Thread B (another map update holds mdsc->mutex or session teardown) -------------------------- -------------------------- s = mdsc->sessions[i] (refcount == 1, held only by sessions[] array) mutex_unlock(&mdsc->mutex) ---> acquires mdsc->mutex __unregister_session(mdsc, s) sessions[i] = NULL ceph_put_mds_session(s) refcount: 1 -> 0 kfree(s) <--- freed! mutex_lock(&s->s_mutex) UAF on freed s->s_mutex The Linux kernel CVE team has assigned CVE-2026-89654 to this issue. Affected and fixed versions =========================== Fixed in 7.2.4 with commit 21d5be092d947f8d83f76f7ebf3989e7e9230a98 Fixed in 7.3-rc1 with commit ee611a7509554c4ca1f54f6aefe592fb1df7ea70 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-89654 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/ceph/mds_client.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/21d5be092d947f8d83f76f7ebf3989e7e9230a98 https://git.kernel.org/stable/c/ee611a7509554c4ca1f54f6aefe592fb1df7ea70