CVE-2026-89654

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix UAF in check new map() on session freed during unlock

check new map() iterates mdsc->sessions[] and for each active session drops mdsc->mutex to perform per-session operations. The forced-close path (rank removed from map) correctly takes a reference on s via ceph get mds session() before releasing mdsc->mutex, but three other paths do not:

Path A (address changed): mutex unlock → mutex lock(&s->s mutex) Path B (reconnect): mutex unlock → send mds reconnect(mdsc, s) Path C (active transition): mutex unlock → mutex lock(&s->s mutex)

Without the extra reference, another thread can acquire mdsc->mutex during the unlock window, call unregister session() which drops the last reference on s, and free it. The original thread then accesses freed memory via s->s mutex.

Fix by adding ceph get mds session(s) before each mutex unlock and ceph put mds session(s) after the corresponding mutex lock, matching the pattern already used in the forced-close path.

Race timeline (Path A):

Thread A (check new map) Thread B (another map update holds mdsc->mutex or session teardown)

s = mdsc->sessions[i] (refcount == 1, held only by sessions[] array)

mutex unlock(&mdsc->mutex) ---> acquires mdsc->mutex unregister session(mdsc, s) sessions[i] = NULL ceph put mds session(s) refcount: 1 -> 0 kfree(s) <--- freed!

mutex lock(&s->s mutex) UAF on freed s->s mutex