CVE-2026-89646

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix leaked inode reference on writeback abort at umount

ceph dirty folio() takes a wrbuffer claim on each newly dirtied folio: it bumps i wrbuffer ref (taking an ihold() on the 0->1 transition) and attaches the snap context to folio->private. That claim is released only by ceph put wrbuffer cap refs(), which for a submitted write runs from writepages finish().

In ceph submit write(), if ceph inc osd stopping blocker() fails -- which happens during umount -- the request is aborted before submission: the already-collected folios are only redirtied and unlocked, so writepages finish() never runs and the claim is leaked. redirty page for writepage() -> folio redirty for writepage() -> filemap dirty folio() sets PG dirty directly and does not go through ->dirty folio, so ceph dirty folio() is not re-entered to rebalance it. Because every subsequent writeback also fails the osd stopping blocker, i wrbuffer ref never returns to 0, the ihold() is never dropped, and the inode cannot be evicted:

VFS: Busy inodes after unmount of ceph kernel BUG at fs/super.c:650!

Release the orphaned claim in the abort path before redirtying, via ceph undo wrbuffer claim(): detach the snap context, drop the wrbuffer reference (letting i wrbuffer ref reach 0 and iput() the inode), and drop the snap context reference -- i.e. do what writepages finish() would have done for these never-submitted folios.

Only the locked pages entries are undone; folios still in the fbatch were never dirty-cleared by this call (folio clear dirty for io() is the ownership-transfer point, and a successful move NULLs the fbatch slot), so they hold no claim this call owns.