CVE-2026-89655
This vulnerability is a use‑after‑free in the Linux kernel’s Ceph file‑system module. It allows an attacker to crash or potentially take control of a system that runs Ceph. The flaw is triggered when a flush message is sent and the corresponding entry is freed before the loop finishes.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users running the Ceph file‑system module, especially those operating Ceph storage clusters. Any system with a kernel that has not yet been updated to include the patch is vulnerable.
Real-world impact
An attacker who can send crafted Ceph messages could cause the kernel to dereference freed memory, leading to a crash or arbitrary code execution on the affected host.
Why this severity
The CVSS score of 9.8 reflects that the flaw requires no authentication, has no user interaction, and gives an attacker complete control over confidentiality, integrity, and availability.
What to do about it
- 01Upgrade the Linux kernel to a version that includes the Ceph UAF fix.
- 02Reboot the system to load the updated kernel.
NVD-referenced vendor advisory
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 13, 2026 · 7h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.