CVE-2026-89655 Linux CVE debrief

Who should care

Linux kernel developers, administrators who use the ceph component, and security teams should be aware of this vulnerability and take steps to mitigate it. Those responsible for maintaining and securing Linux kernel deployments that utilize ceph are particularly impacted. They must assess their exposure, apply patches or updates, and monitor for suspicious activity to prevent potential exploitation.

Why it matters

The CVE-2026-89655 vulnerability in the Linux kernel's ceph component requires immediate attention from Linux kernel developers and administrators. The use-after-free error can cause denial of service and potentially allow arbitrary code execution. Patching and updating the Linux kernel is necessary to mitigate this vulnerability.

• Denial of service due to use-after-free error
• Potential for arbitrary code execution
• Need for patching and updating Linux kernel
• Monitoring required for suspicious activity

Technical summary

The __kick_flushing_caps() function in the Linux kernel's ceph component is vulnerable to a use-after-free error. The function iterates over the ci->i_cap_flush_list and drops the i_ceph_lock to send cap messages. During the unlock window, handle_cap_flush_ack() can acquire i_ceph_lock, detach cf entries with tid <= flush_tid from the list, release i_ceph_lock, and free them via ceph_free_cap_flush() outside any lock. When the original thread reacquires i_ceph_lock and the for-loop macro advances via cf = list_next_entry(cf, i_list), it dereferences cf->i_list.next on freed memory.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches to fix the vulnerability
• Ensure that the Linux kernel is updated to a version that includes the fix
• Monitor the Linux kernel's ceph component for any suspicious activity
• Perform a thorough review of the system's exposure to this vulnerability
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by a use-after-free error in the __kick_flushing_caps() function. The function iterates over the ci->i_cap_flush_list and drops the i_ceph_lock to send cap messages. During the unlock window, handle_cap_flush_ack() can acquire i_ceph_lock, detach cf entries with tid <= flush_tid from the list, release i_ceph_lock, and free them via ceph_free_cap_flush() outside any lock.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.