Description

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in check_new_map() on session freed during unlock check_new_map() iterates mdsc->sessions[] and for each active session drops mdsc->mutex to perform per-session operations. The forced-close path (rank removed from map) correctly takes a reference on s via ceph_get_mds_session() before releasing mdsc->mutex, but three other paths do not: Path A (address changed): mutex_unlock → mutex_lock(&s->s_mutex) Path B (reconnect): mutex_unlock → send_mds_reconnect(mdsc, s) Path C (active transition): mutex_unlock → mutex_lock(&s->s_mutex) Without the extra reference, another thread can acquire mdsc->mutex during the unlock window, call __unregister_session() which drops the last reference on s, and free it. The original thread then accesses freed memory via s->s_mutex. Fix by adding ceph_get_mds_session(s) before each mutex_unlock and ceph_put_mds_session(s) after the corresponding mutex_lock, matching the pattern already used in the forced-close path. Race timeline (Path A): Thread A (check_new_map) Thread B (another map update holds mdsc->mutex or session teardown) -------------------------- -------------------------- s = mdsc->sessions[i] (refcount == 1, held only by sessions[] array) mutex_unlock(&mdsc->mutex) ---> acquires mdsc->mutex __unregister_session(mdsc, s) sessions[i] = NULL ceph_put_mds_session(s) refcount: 1 -> 0 kfree(s) <--- freed! mutex_lock(&s->s_mutex) UAF on freed s->s_mutex

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:51.540Z",
  "pubdate": "2026-09-11T20:19:51.540Z",
  "executiveSummary": "A Use-After-Free (UAF) vulnerability exists in the Ceph filesystem component of the Linux kernel, specifically within the check_new_map() function.\nThe vulnerability occurs due to improper lifecycle management of MDS session objects during concurrent access.\nIf a session is freed while the mdsc->mutex is unlocked, subsequent operations on the dangling pointer result in memory corruption or arbitrary code execution.\nThe vulnerability affects systems utilizing the Ceph network filesystem.\nAn attacker capable of triggering specific map update sequences or session teardowns could potentially cause a kernel panic, leading to a Denial of Service (DoS).\nWhile exploitation is complex, local privilege escalation or arbitrary kernel memory manipulation cannot be entirely ruled out in certain configurations.",
  "technicalDetails": "The root cause of this vulnerability is an inconsistent reference counting mechanism in the check_new_map() function within the Ceph client. During the processing of MDS maps, the kernel iterates through the mdsc->sessions array. To perform per-session operations, the function temporarily releases the mdsc->mutex to avoid deadlocks or blocking behavior.\nIn several code paths—specifically during MDS address changes (Path A), session reconnection (Path B), and active transition states (Path C)—the code fails to increment the reference count of the session object (struct ceph_mds_session) before dropping the mutex. The session object is protected only by the reference stored in the mdsc->sessions array while the lock is held.\nA race condition is introduced when Thread A releases the mdsc->mutex. A concurrent Thread B can acquire the same lock, invoke __unregister_session() for the same session, and trigger the final put operation. If the reference count drops to zero, the kernel immediately invokes kfree() on the session object.\nOnce the mutex is re-acquired by Thread A, it proceeds to perform operations such as mutex_lock(&s->s_mutex) or send_mds_reconnect(mdsc, s). Because the memory previously pointed to by 's' has been freed and potentially reallocated for other kernel structures, this results in a Use-After-Free (UAF) condition.\nThe vulnerability is exposed when the kernel processes network-based metadata updates. A remote Ceph MDS node or a malicious local user capable of triggering frequent map updates could synchronize the race window to force the UAF.\nSuccessful exploitation leads to memory corruption within the kernel heap. If an attacker can control the contents of the memory reallocated to the freed session object, they may achieve control over function pointers or mutex structures contained within the session struct, leading to arbitrary kernel code execution or kernel privilege escalation.\nThe fix involves standardizing the object lifecycle management by ensuring ceph_get_mds_session(s) is called immediately prior to unlocking the mutex, and ceph_put_mds_session(s) is called once the operation requiring the session object is complete. This ensures the object remains allocated regardless of concurrent teardown requests."
}