CRITICAL Introduced in 6.10
ceph CapAuths UAF
CVE-2026-89990
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.8MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: ceph: lock mutex in ceph_mds_check_access() MDS session OPEN handling replaces mdsc->s_cap_auths under mdsc->mutex, freeing the previous array and its strings. ceph_mds_check_access() traverses this array without holding the mutex. A concurrent session reopen can therefore free the array while it is being inspected, resulting in a use-after-free like this: Unable to handle kernel paging request at virtual address 003aaad64b2c8bb9 [...] Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 56 UID: 2953037534 PID: 1253231 Comm: php-cgi8.4 Not tainted 6.18.45-i2-ampere #1146 NONE [..] pc : ceph_mds_check_access+0xd4/0x550 lr : ceph_mds_check_access+0xc8/0x550 [...] Call trace: ceph_mds_check_access+0xd4/0x550 (P) ceph_atomic_open+0x138/0xbe8 path_openat+0xa24/0xfa8 do_filp_open+0x94/0x158 do_sys_openat2+0x88/0xf8
02KernelScan AI Analysis
Risk summary
A local user with access to a mounted Ceph filesystem can trigger a use-after-free in the kernel's Ceph client by racing a file open against an MDS session reopen. The resulting heap corruption can crash the kernel or potentially be exploited for privilege escalation. Any system mounting CephFS and allowing unprivileged users to open files on that mount is affected.
Vulnerability analysis
The Ceph client checks file access by walking an internal array of authorization rules, but it does so without locking against the background thread that manages the MDS session. When that session is reopened—such as during server failover—the old array is freed while the walk is still in progress, causing a use-after-free. The fix wraps the array walk in the same lock that the session management uses, so the free cannot happen mid-check. Any local user with permission to open files on a mounted Ceph filesystem can reach the vulnerable code path; the race window opens when the Ceph client re-establishes an MDS session, which occurs during server reconnection or failover events.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.10 | 6.12.110 | 729c1ff670ec |
| mainline | 6.10 | 7.3-rc2 | a61c6ae1dae2 |
| 6.18 | 6.10 | 6.18.51 | ca5bfea2045e |
| 7.2 | 6.10 | 7.2.5 | df1a97d5313f |
| cip/6.12 | 6.10 | 6.12.111-cip32 | 729c1ff670ec |