{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ceph: fix UAF in check_new_map() on session freed during unlock  check_new_map() iterates mdsc-\u003esessions[] and for each active session drops mdsc-\u003emutex to perform per-session operations.  The forced-close path (rank removed from map) correctly takes a reference on s via ceph_get_mds_session() before releasing mdsc-\u003emutex, but three other paths do not:    Path A (address changed):  mutex_unlock → mutex_lock(\u0026s-\u003es_mutex)   Path B (reconnect):        mutex_unlock → send_mds_reconnect(mdsc, s)   Path C (active transition): mutex_unlock → mutex_lock(\u0026s-\u003es_mutex)  Without the extra reference, another thread can acquire mdsc-\u003emutex during the unlock window, call __unregister_session() which drops the last reference on s, and free it.  The original thread then accesses freed memory via s-\u003es_mutex.  Fix by adding ceph_get_mds_session(s) before each mutex_unlock and ceph_put_mds_session(s) after the corresponding mutex_lock, matching the pattern already used in the forced-close path.  Race timeline (Path A):    Thread A (check_new_map)             Thread B (another map update     holds mdsc-\u003emutex                      or session teardown)   --------------------------           --------------------------   s = mdsc-\u003esessions[i]   (refcount == 1, held only by    sessions[] array)    mutex_unlock(\u0026mdsc-\u003emutex)                                ---\u003e    acquires mdsc-\u003emutex                                        __unregister_session(mdsc, s)                                          sessions[i] = NULL                                          ceph_put_mds_session(s)                                            refcount: 1 -\u003e 0                                            kfree(s)  \u003c--- freed!    mutex_lock(\u0026s-\u003es_mutex)   UAF on freed s-\u003es_mutex",
  "id": "DEBIAN-CVE-2026-89654",
  "modified": "2026-09-14T08:47:33.335313890Z",
  "published": "2026-09-11T20:19:51.540Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-89654"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-89654"
  ]
}