Critical 9.8Published Sep 16, 2026

CVE-2026-89990ceph: lock mutex in ceph_mds_check_access()

Updated under an hour ago (2026-10-19 06:10 UTC)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ceph: lock mutex in ceph_mds_check_access() MDS session OPEN handling replaces mdsc->s_cap_auths under mdsc->mutex, freeing the previous array and its strings. ceph_mds_check_access() traverses this array without holding the mutex. A concurrent session reopen can therefore free the array while it is being inspected, resulting in a use-after-free like this: Unable to handle kernel paging request at virtual address 003aaad64b2c8bb9 [...] Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 56 UID: 2953037534 PID: 1253231 Comm: php-cgi8.4 Not tainted 6.18.45-i2-ampere #1146 NONE [..] pc : ceph_mds_check_access+0xd4/0x550 lr : ceph_mds_check_access+0xc8/0x550 [...] Call trace: ceph_mds_check_access+0xd4/0x550 (P) ceph_atomic_open+0x138/0xbe8 path_openat+0xa24/0xfa8 do_filp_open+0x94/0x158 do_sys_openat2+0x88/0xf8

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Sep 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 596afb0b8933ba6ed7227adcc538db26feb25c74 before 729c1ff670ece6f3d4b1738365a0b2f90d487523; from 596afb0b8933ba6ed7227adcc538db26feb25c74 before ca5bfea2045ef2eb3305cf2a9d8da549b76c37d3; from 596afb0b8933ba6ed7227adcc538db26feb25c74 before df1a97d5313fccadb08390306d49b194fb027392; from 596afb0b8933ba6ed7227adcc538db26feb25c74 before a61c6ae1dae2611082b831b4aaa780878099c012	CNA record

References

https://git.kernel.org/stable/c/729c1ff670ece6f3d4b1738365a0b2f90d487523
https://git.kernel.org/stable/c/ca5bfea2045ef2eb3305cf2a9d8da549b76c37d3
https://git.kernel.org/stable/c/df1a97d5313fccadb08390306d49b194fb027392
https://git.kernel.org/stable/c/a61c6ae1dae2611082b831b4aaa780878099c012

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.