{"id":"AZL-100770","summary":"CVE-2026-89654 affecting package kernel 6.6.150.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix UAF in check_new_map() on session freed during unlock\n\ncheck_new_map() iterates mdsc-\u003esessions[] and for each active session\ndrops mdsc-\u003emutex to perform per-session operations.  The forced-close\npath (rank removed from map) correctly takes a reference on s via\nceph_get_mds_session() before releasing mdsc-\u003emutex, but three other\npaths do not:\n\n  Path A (address changed):  mutex_unlock → mutex_lock(&s-\u003es_mutex)\n  Path B (reconnect):        mutex_unlock → send_mds_reconnect(mdsc, s)\n  Path C (active transition): mutex_unlock → mutex_lock(&s-\u003es_mutex)\n\nWithout the extra reference, another thread can acquire mdsc-\u003emutex\nduring the unlock window, call __unregister_session() which drops the\nlast reference on s, and free it.  The original thread then accesses\nfreed memory via s-\u003es_mutex.\n\nFix by adding ceph_get_mds_session(s) before each mutex_unlock and\nceph_put_mds_session(s) after the corresponding mutex_lock, matching\nthe pattern already used in the forced-close path.\n\nRace timeline (Path A):\n\n  Thread A (check_new_map)             Thread B (another map update\n    holds mdsc-\u003emutex                      or session teardown)\n  --------------------------           --------------------------\n  s = mdsc-\u003esessions[i]\n  (refcount == 1, held only by\n   sessions[] array)\n\n  mutex_unlock(&mdsc-\u003emutex)\n                               ---\u003e    acquires mdsc-\u003emutex\n                                       __unregister_session(mdsc, s)\n                                         sessions[i] = NULL\n                                         ceph_put_mds_session(s)\n                                           refcount: 1 -\u003e 0\n                                           kfree(s)  \u003c--- freed!\n\n  mutex_lock(&s-\u003es_mutex)\n  UAF on freed s-\u003es_mutex","modified":"2026-09-13T06:06:36Z","published":"2026-09-11T20:19:51Z","upstream":["CVE-2026-89654"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89654"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.150.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-100770.json"}}],"schema_version":"1.9.0"}