Linux Kernel EUVD-2026-76566

Requires a host with a mounted CephFS filesystem processing MDS map updates, and an attacker able to influence session state transitions - realistically a malicious, compromised, or misbehaving Ceph MDS/monitor, or a man-in-the-middle on an unsigned (non-cephx-authenticated) messenger connection. Exploitation further depends on winning a race: a second thread must call __unregister_session() and free the session during the exact window in which check_new_map() has dropped mdsc->mutex on the address-changed, reconnect, or active-transition path. Limiting factors: the client must be running a vulnerable kernel with CephFS mounted, the attacker must control cluster-side map/session behavior, and the timing window is small (high attack complexity), so this is not exploitable against default, non-CephFS systems.

The input CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) substantially overstates real-world risk. This is a race-condition use-after-free reachable only on a host that has mounted a CephFS filesystem, and it is driven by MDS map updates - realistically requiring a malicious, compromised, or misbehaving Ceph MDS/monitor (or an unsigned-messenger MITM) rather than an arbitrary remote actor, so attack vector is better modelled as adjacent and attack complexity as high because the attacker must win a narrow unlock-window race. The primary observable impact is memory corruption leading to a kernel crash (denial of service); the assigned 'Information Disclosure' tag understates the write-capable UAF nature, and the C:H/I:H rating is speculative absent a demonstrated exploitation primitive. EPSS is 0.16% (6th percentile), there is no CISA KEV listing and no public PoC, which is consistent with a hard-to-win in-kernel race rather than a mass-exploitable network flaw; even a mid-sized municipal IT team in inowroclaw running CephFS should patch on the normal kernel-update cadence rather than as an emergency. In short: real but config-gated and low-probability, not a drop-everything network RCE despite the headline score.

An attacker who controls or has compromised a Ceph MDS (or can MITM an unsigned Ceph messenger session) pushes rapid MDS map updates that force address-change/reconnect/active-transition handling on a mounted client while simultaneously triggering session teardown. By winning the narrow window after check_new_map() drops mdsc->mutex, the session is freed and the client dereferences freed memory, crashing the kernel or corrupting memory. No public exploit code is known, and the required race makes reliable exploitation difficult.