CVE-2026-89646

ceph: fix leaked inode reference on writeback abort at umount

Published Sep 11, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix leaked inode reference on writeback abort at umount

ceph_dirty_folio() takes a wrbuffer claim on each newly dirtied folio: it
bumps i_wrbuffer_ref (taking an ihold() on the 0->1 transition) and
attaches the snap_context to folio->private. That claim is released only
by ceph_put_wrbuffer_cap_refs(), which for a submitted write runs from
writepages_finish().

In ceph_submit_write(), if ceph_inc_osd_stopping_blocker() fails -- which
happens during umount -- the request is aborted before submission: the
already-collected folios are only redirtied and unlocked, so
writepages_finish() never runs and the claim is leaked.
redirty_page_for_writepage() -> folio_redirty_for_writepage() ->
filemap_dirty_folio() sets PG_dirty directly and does not go through
->dirty_folio, so ceph_dirty_folio() is not re-entered to rebalance it.
Because every subsequent writeback also fails the osd_stopping_blocker,
i_wrbuffer_ref never returns to 0, the ihold() is never dropped, and the
inode cannot be evicted:

VFS: Busy inodes after unmount of ceph
kernel BUG at fs/super.c:650!

Release the orphaned claim in the abort path before redirtying, via
ceph_undo_wrbuffer_claim(): detach the snap_context, drop the wrbuffer
reference (letting i_wrbuffer_ref reach 0 and iput() the inode), and drop
the snap_context reference -- i.e. do what writepages_finish() would have
done for these never-submitted folios.

Only the locked_pages entries are undone; folios still in the fbatch were
never dirty-cleared by this call (folio_clear_dirty_for_io() is the
ownership-transfer point, and a successful move NULLs the fbatch slot), so
they hold no claim this call owns.

Analysis

Technical impact

The Linux kernel’s Ceph filesystem contains a reference‑counting flaw (CWE‑911) that arises when a write operation is aborted during an unmount. The flawed logic retains an inode writeback reference that is never released, keeping the inode’s reference count non‑zero. This leads to a kernel BUG, manifested by the message "VFS: Busy inodes after unmount of ceph" and a fault at fs/super.c:650.

Affected Systems

The vulnerability exists in the Linux kernel particularly in the Ceph filesystem support; no specific kernel release numbers were enumerated, so all unpatched kernels that use Ceph are potentially impacted.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity flaw, but the EPSS score shows a very low exploitation probability (<1%) and the vulnerability is not listed in CISA's KEV catalog. The bug appears to be triggered during an unmount operation when a Ceph writeback is aborted, an attack scenario inferred from the description; an attacker would need privileged access to the system to perform the dismount while a write is in progress, making exploitation difficult. Though the flaw can lead to a kernel crash with a VFS BUSY inode error, the practicality of exploitation remains limited under normal conditions.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`fd7449d937e7fb3144770592927cf452bf66dbd3`	affected	< ec32015a955c5d326c5e26610edfdcccd52f2314
`fd7449d937e7fb3144770592927cf452bf66dbd3`	affected	< ac7a5a5385762df458d10cccc086a4e079be7409
`fd7449d937e7fb3144770592927cf452bf66dbd3`	affected	< c25aee9c630fb86f98d79eccb75765067079b972

Linux

affected

Version	Status	Constraints
`6.15`	affected	—
`0`	unaffected	< 6.15
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[fd7449d937e7fb3144770592927cf452bf66dbd3,ec32015a955c5d326c5e26610edfdcccd52f2314)`	affected	code_commit	—
`[fd7449d937e7fb3144770592927cf452bf66dbd3,ac7a5a5385762df458d10cccc086a4e079be7409)`	affected	code_commit	—
`[fd7449d937e7fb3144770592927cf452bf66dbd3,c25aee9c630fb86f98d79eccb75765067079b972)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.15`	affected	generic	—
`[0,6.15)`	unaffected	generic	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the Ceph patch
If a newer kernel is not immediately available, apply the upstream patch that releases proper inode reference cleanup during umount
If no patch is available, unmount the Ceph filesystem and reboot the system to clear stuck inode references, then remount

Generated by OpenCVE AI on September 15, 2026 at 21:19 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.173% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/ac7a5a5385762df458d10cccc086a4e079be7409
https://git.kernel.org/stable/c/c25aee9c630fb86f98d79eccb75765067079b972
https://git.kernel.org/stable/c/ec32015a955c5d326c5e26610edfdcccd52f2314
https://nvd.nist.gov/vuln/detail/CVE-2026-89646
https://www.cve.org/CVERecord?id=CVE-2026-89646

History

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sep 12, 2026 4:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-772

Sep 12, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-911
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89646 https://www.cve.org/CVERecord?id=CVE-2026-89646
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sep 12, 2026 10:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-772

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount ceph_dirty_folio() takes a wrbuffer claim on each newly dirtied folio: it bumps i_wrbuffer_ref (taking an ihold() on the 0->1 transition) and attaches the snap_context to folio->private. That claim is released only by ceph_put_wrbuffer_cap_refs(), which for a submitted write runs from writepages_finish(). In ceph_submit_write(), if ceph_inc_osd_stopping_blocker() fails -- which happens during umount -- the request is aborted before submission: the already-collected folios are only redirtied and unlocked, so writepages_finish() never runs and the claim is leaked. redirty_page_for_writepage() -> folio_redirty_for_writepage() -> filemap_dirty_folio() sets PG_dirty directly and does not go through ->dirty_folio, so ceph_dirty_folio() is not re-entered to rebalance it. Because every subsequent writeback also fails the osd_stopping_blocker, i_wrbuffer_ref never returns to 0, the ihold() is never dropped, and the inode cannot be evicted: VFS: Busy inodes after unmount of ceph kernel BUG at fs/super.c:650! Release the orphaned claim in the abort path before redirtying, via ceph_undo_wrbuffer_claim(): detach the snap_context, drop the wrbuffer reference (letting i_wrbuffer_ref reach 0 and iput() the inode), and drop the snap_context reference -- i.e. do what writepages_finish() would have done for these never-submitted folios. Only the locked_pages entries are undone; folios still in the fbatch were never dirty-cleared by this call (folio_clear_dirty_for_io() is the ownership-transfer point, and a successful move NULLs the fbatch slot), so they hold no claim this call owns.
Title		ceph: fix leaked inode reference on writeback abort at umount
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/ac7a5a5385762df458d10cccc086a4e079be7409 https://git.kernel.org/stable/c/c25aee9c630fb86f98d79eccb75765067079b972 https://git.kernel.org/stable/c/ec32015a955c5d326c5e26610edfdcccd52f2314