EUVD-2026-76566
GHSA-hwg3-wmfr-8q53
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reachable only via a mounted CephFS driven by a malicious MDS (adjacent) through a narrow session-free race (AC:H); impact is memory corruption/crash (A:H) with no demonstrated confidentiality/integrity primitive.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix UAF in check_new_map() on session freed during unlock
check_new_map() iterates mdsc->sessions[] and for each active session drops mdsc->mutex to perform per-session operations. The forced-close path (rank removed from map) correctly takes a reference on s via ceph_get_mds_session() before releasing mdsc->mutex, but three other paths do not:
Path A (address changed): mutex_unlock → mutex_lock(&s->s_mutex) Path B (reconnect): mutex_unlock → send_mds_reconnect(mdsc, s) Path C (active transition): mutex_unlock → mutex_lock(&s->s_mutex)
Without the extra reference, another thread can acquire mdsc->mutex during the unlock window, call __unregister_session() which drops the last reference on s, and free it. The original thread then accesses freed memory via s->s_mutex.
Fix by adding ceph_get_mds_session(s) before each mutex_unlock and ceph_put_mds_session(s) after the corresponding mutex_lock, matching the pattern already used in the forced-close path.
Race timeline (Path A):
Thread A (check_new_map) Thread B (another map update holds mdsc->mutex or session teardown) -------------------------- -------------------------- s = mdsc->sessions[i] (refcount == 1, held only by sessions[] array)
mutex_unlock(&mdsc->mutex) ---> acquires mdsc->mutex __unregister_session(mdsc, s) sessions[i] = NULL ceph_put_mds_session(s) refcount: 1 -> 0 kfree(s) <--- freed!
mutex_lock(&s->s_mutex) UAF on freed s->s_mutex
AnalysisAI
Use-after-free in the Linux kernel CephFS client (check_new_map()) lets a freed ceph_mds_session be dereferenced during MDS map processing, enabling memory corruption and likely denial of service on machines with a mounted CephFS. When check_new_map() releases mdsc->mutex to handle a session's address change, reconnect, or active transition, it fails to take a reference on the session (unlike the forced-close path), so a concurrent thread can unregister and kfree that session before the original thread touches s->s_mutex. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a host with a mounted CephFS filesystem processing MDS map updates, and an attacker able to influence session state transitions - realistically a malicious, compromised, or misbehaving Ceph MDS/monitor, or a man-in-the-middle on an unsigned (non-cephx-authenticated) messenger connection. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) substantially overstates real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux kernel 7.2.4 (or 7.3-rc1) or a distribution kernel that incorporates commits 21d5be09 / ee611a75, which add ceph_get_mds_session(s) before each mutex_unlock and ceph_put_mds_session(s) after the corresponding lock in check_new_map(), matching the forced-close path. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems with mounted CephFS and their current kernel versions, noting any running versions prior to 7.2.4. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today