CVE-2026-89655

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A Use-After-Free (UAF) issue exists in the ceph component of the Linux kernel. The kick flushing caps() function iterates through the ci->i cap flush list using list for each entry() but releases the i ceph lock to send capability messages. During this window, the handle cap flush ack() function can acquire the i ceph lock, detach entries where the tid is less than or equal to flush tid, and free them via ceph free cap flush(). When the original thread reacquires the lock and attempts to advance the loop using list next entry(), it dereferences cf->i list.next on memory that has already been freed. This occurs because the Metadata Server (MDS) may respond with a FLUSH ACK quickly enough to trigger the free before the iteration completes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.