GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89646 (GCVE-0-2026-89646)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:45 – Updated: 2026-09-13 06:32
VLAI
Title
ceph: fix leaked inode reference on writeback abort at umount
Summary
In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount ceph_dirty_folio() takes a wrbuffer claim on each newly dirtied folio: it bumps i_wrbuffer_ref (taking an ihold() on the 0->1 transition) and attaches the snap_context to folio->private. That claim is released only by ceph_put_wrbuffer_cap_refs(), which for a submitted write runs from writepages_finish(). In ceph_submit_write(), if ceph_inc_osd_stopping_blocker() fails -- which happens during umount -- the request is aborted before submission: the already-collected folios are only redirtied and unlocked, so writepages_finish() never runs and the claim is leaked. redirty_page_for_writepage() -> folio_redirty_for_writepage() -> filemap_dirty_folio() sets PG_dirty directly and does not go through ->dirty_folio, so ceph_dirty_folio() is not re-entered to rebalance it. Because every subsequent writeback also fails the osd_stopping_blocker, i_wrbuffer_ref never returns to 0, the ihold() is never dropped, and the inode cannot be evicted: VFS: Busy inodes after unmount of ceph kernel BUG at fs/super.c:650! Release the orphaned claim in the abort path before redirtying, via ceph_undo_wrbuffer_claim(): detach the snap_context, drop the wrbuffer reference (letting i_wrbuffer_ref reach 0 and iput() the inode), and drop the snap_context reference -- i.e. do what writepages_finish() would have done for these never-submitted folios. Only the locked_pages entries are undone; folios still in the fbatch were never dirty-cleared by this call (folio_clear_dirty_for_io() is the ownership-transfer point, and a successful move NULLs the fbatch slot), so they hold no claim this call owns.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fd7449d937e7fb3144770592927cf452bf66dbd3 , < ec32015a955c5d326c5e26610edfdcccd52f2314 (git)
Affected: fd7449d937e7fb3144770592927cf452bf66dbd3 , < ac7a5a5385762df458d10cccc086a4e079be7409 (git)
Affected: fd7449d937e7fb3144770592927cf452bf66dbd3 , < c25aee9c630fb86f98d79eccb75765067079b972 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/addr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ec32015a955c5d326c5e26610edfdcccd52f2314",
              "status": "affected",
              "version": "fd7449d937e7fb3144770592927cf452bf66dbd3",
              "versionType": "git"
            },
            {
              "lessThan": "ac7a5a5385762df458d10cccc086a4e079be7409",
              "status": "affected",
              "version": "fd7449d937e7fb3144770592927cf452bf66dbd3",
              "versionType": "git"
            },
            {
              "lessThan": "c25aee9c630fb86f98d79eccb75765067079b972",
              "status": "affected",
              "version": "fd7449d937e7fb3144770592927cf452bf66dbd3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/addr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix leaked inode reference on writeback abort at umount\n\nceph_dirty_folio() takes a wrbuffer claim on each newly dirtied folio: it\nbumps i_wrbuffer_ref (taking an ihold() on the 0-\u003e1 transition) and\nattaches the snap_context to folio-\u003eprivate.  That claim is released only\nby ceph_put_wrbuffer_cap_refs(), which for a submitted write runs from\nwritepages_finish().\n\nIn ceph_submit_write(), if ceph_inc_osd_stopping_blocker() fails -- which\nhappens during umount -- the request is aborted before submission: the\nalready-collected folios are only redirtied and unlocked, so\nwritepages_finish() never runs and the claim is leaked.\nredirty_page_for_writepage() -\u003e folio_redirty_for_writepage() -\u003e\nfilemap_dirty_folio() sets PG_dirty directly and does not go through\n-\u003edirty_folio, so ceph_dirty_folio() is not re-entered to rebalance it.\nBecause every subsequent writeback also fails the osd_stopping_blocker,\ni_wrbuffer_ref never returns to 0, the ihold() is never dropped, and the\ninode cannot be evicted:\n\n  VFS: Busy inodes after unmount of ceph\n  kernel BUG at fs/super.c:650!\n\nRelease the orphaned claim in the abort path before redirtying, via\nceph_undo_wrbuffer_claim(): detach the snap_context, drop the wrbuffer\nreference (letting i_wrbuffer_ref reach 0 and iput() the inode), and drop\nthe snap_context reference -- i.e. do what writepages_finish() would have\ndone for these never-submitted folios.\n\nOnly the locked_pages entries are undone; folios still in the fbatch were\nnever dirty-cleared by this call (folio_clear_dirty_for_io() is the\nownership-transfer point, and a successful move NULLs the fbatch slot), so\nthey hold no claim this call owns."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The leak is in ceph_submit_write() from ceph_writepages_start() during local VFS writeback on umount (ceph_kill_sb \u2192 sync_filesystem \u2192 do_writepages), not MDS/OSD message handlers. fs/ceph is a kernel client with no network-facing server listener.\nAC:L - Dirtying pages then unmounting drives both sides: ceph_kill_sb waits at most mount_timeout (default 60s) or a killable signal, then sets STOPPING_FLUSHING while writepages_start still holds a blocker and locked folios, so the abort is reached reliably without an uncontrolled race.\nPR:L - An unprivileged user with write access to an already-mounted CephFS can dirty pages; container/pod teardown, autofs, or systemd performs the umount. CephFS lacks FS_USERNS_MOUNT, but the attacker does not need CAP_SYS_ADMIN themselves.\nUI:N - The attacker dirties files and can trigger or wait for unmount via pod exit, autofs idle unmount, or their own umount; no separate victim action such as opening a file or mounting the filesystem is required.\nS:U - The leaked inode references and subsequent superblock teardown affect only the host kernel\u0027s VFS/Ceph client state within the same security authority; this is not a VM escape, IOMMU bypass, or sandbox escape.\nC:H - The leaked ihold pins inodes through generic_shutdown_super so the superblock and ceph_fs_client are destroyed while those inodes remain. Later writeback or iput on the leftover mapping is a use-after-free of the freed superblock, scored High per UAF guidance.\nI:H - Inodes that survive umount retain address_spaces and pointers into destroyed ceph_fs_client/mdsc state. Subsequent iput_final/writeback operate on freed objects and poisoned i_op/s_op, a UAF write and control-flow primitive scored High.\nA:H - Unmount reports \"VFS: Busy inodes after unmount of ceph\" and hits CHECK_DATA_CORRUPTION in generic_shutdown_super (BUG() with CONFIG_BUG_ON_DATA_CORRUPTION), and VFS_PTR_POISON on surviving inodes guarantees a later oops or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:32:24.201Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ec32015a955c5d326c5e26610edfdcccd52f2314"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac7a5a5385762df458d10cccc086a4e079be7409"
        },
        {
          "url": "https://git.kernel.org/stable/c/c25aee9c630fb86f98d79eccb75765067079b972"
        }
      ],
      "title": "ceph: fix leaked inode reference on writeback abort at umount",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89646",
    "datePublished": "2026-09-11T19:45:37.767Z",
    "dateReserved": "2026-09-11T19:38:34.741Z",
    "dateUpdated": "2026-09-13T06:32:24.201Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89646",
      "date": "2026-09-16",
      "epss": "0.00173",
      "percentile": "0.07027"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89646\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:50.477\",\"lastModified\":\"2026-09-13T07:17:29.710\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nceph: fix leaked inode reference on writeback abort at umount\\n\\nceph_dirty_folio() takes a wrbuffer claim on each newly dirtied folio: it\\nbumps i_wrbuffer_ref (taking an ihold() on the 0-\u003e1 transition) and\\nattaches the snap_context to folio-\u003eprivate.  That claim is released only\\nby ceph_put_wrbuffer_cap_refs(), which for a submitted write runs from\\nwritepages_finish().\\n\\nIn ceph_submit_write(), if ceph_inc_osd_stopping_blocker() fails -- which\\nhappens during umount -- the request is aborted before submission: the\\nalready-collected folios are only redirtied and unlocked, so\\nwritepages_finish() never runs and the claim is leaked.\\nredirty_page_for_writepage() -\u003e folio_redirty_for_writepage() -\u003e\\nfilemap_dirty_folio() sets PG_dirty directly and does not go through\\n-\u003edirty_folio, so ceph_dirty_folio() is not re-entered to rebalance it.\\nBecause every subsequent writeback also fails the osd_stopping_blocker,\\ni_wrbuffer_ref never returns to 0, the ihold() is never dropped, and the\\ninode cannot be evicted:\\n\\n  VFS: Busy inodes after unmount of ceph\\n  kernel BUG at fs/super.c:650!\\n\\nRelease the orphaned claim in the abort path before redirtying, via\\nceph_undo_wrbuffer_claim(): detach the snap_context, drop the wrbuffer\\nreference (letting i_wrbuffer_ref reach 0 and iput() the inode), and drop\\nthe snap_context reference -- i.e. do what writepages_finish() would have\\ndone for these never-submitted folios.\\n\\nOnly the locked_pages entries are undone; folios still in the fbatch were\\nnever dirty-cleared by this call (folio_clear_dirty_for_io() is the\\nownership-transfer point, and a successful move NULLs the fbatch slot), so\\nthey hold no claim this call owns.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ceph/addr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"fd7449d937e7fb3144770592927cf452bf66dbd3\",\"lessThan\":\"ec32015a955c5d326c5e26610edfdcccd52f2314\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fd7449d937e7fb3144770592927cf452bf66dbd3\",\"lessThan\":\"ac7a5a5385762df458d10cccc086a4e079be7409\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fd7449d937e7fb3144770592927cf452bf66dbd3\",\"lessThan\":\"c25aee9c630fb86f98d79eccb75765067079b972\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ceph/addr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/ac7a5a5385762df458d10cccc086a4e079be7409\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c25aee9c630fb86f98d79eccb75765067079b972\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ec32015a955c5d326c5e26610edfdcccd52f2314\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-09-15T08:12:17+00:00",
      "cve": "CVE-2026-89646",
      "id": "CVE-2026-89646",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "200",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ceph: fix leaked inode reference on writeback abort at umount",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89646.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:01:16Z",
      "cve": "CVE-2026-89646",
      "id": "CVE-2026-89646",
      "initial_release_date": "2026-09-12T16:24:20Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89646",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89646.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.