9.8

CVE-2026-89990

ceph: lock mutex in ceph_mds_check_access()

In the Linux kernel, the following vulnerability has been resolved:

ceph: lock mutex in ceph_mds_check_access()

MDS session OPEN handling replaces mdsc->s_cap_auths under
mdsc->mutex, freeing the previous array and its strings.

ceph_mds_check_access() traverses this array without holding the
mutex.  A concurrent session reopen can therefore free the array while
it is being inspected, resulting in a use-after-free like this:

  Unable to handle kernel paging request at virtual address 003aaad64b2c8bb9
  [...]
  Internal error: Oops: 0000000096000004 [#1]  SMP
  Modules linked in:
  CPU: 56 UID: 2953037534 PID: 1253231 Comm: php-cgi8.4 Not tainted 6.18.45-i2-ampere #1146 NONE
  [..]
  pc : ceph_mds_check_access+0xd4/0x550
  lr : ceph_mds_check_access+0xc8/0x550
  [...]
  Call trace:
   ceph_mds_check_access+0xd4/0x550 (P)
   ceph_atomic_open+0x138/0xbe8
   path_openat+0xa24/0xfa8
   do_filp_open+0x94/0x158
   do_sys_openat2+0x88/0xf8
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 596afb0b8933ba6ed7227adcc538db26feb25c74
Version < 729c1ff670ece6f3d4b1738365a0b2f90d487523
Status affected
Version 596afb0b8933ba6ed7227adcc538db26feb25c74
Version < ca5bfea2045ef2eb3305cf2a9d8da549b76c37d3
Status affected
Version 596afb0b8933ba6ed7227adcc538db26feb25c74
Version < df1a97d5313fccadb08390306d49b194fb027392
Status affected
Version 596afb0b8933ba6ed7227adcc538db26feb25c74
Version < a61c6ae1dae2611082b831b4aaa780878099c012
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 6.10
Status affected
Version 0
Version < 6.10
Status unaffected
Version <= 6.12.*
Version 6.12.110
Status unaffected
Version <= 6.18.*
Version 6.18.51
Status unaffected
Version <= 7.2.*
Version 7.2.5
Status unaffected
Version <= *
Version 7.3-rc2
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.61% 0.477
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/729c1ff670ece6f3d4b1738365a0b2f90d487523
https://git.kernel.org/stable/c/ca5bfea2045ef2eb3305cf2a9d8da549b76c37d3
https://git.kernel.org/stable/c/df1a97d5313fccadb08390306d49b194fb027392
https://git.kernel.org/stable/c/a61c6ae1dae2611082b831b4aaa780878099c012