CVE-2026-89646

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix leaked inode reference on writeback abort at umount

ceph_dirty_folio() takes a wrbuffer claim on each newly dirtied folio: it

bumps i_wrbuffer_ref (taking an ihold() on the 0->1 transition) and

attaches the snap_context to folio->private. That claim is released only

by ceph_put_wrbuffer_cap_refs(), which for a submitted write runs from

writepages_finish().

In ceph_submit_write(), if ceph_inc_osd_stopping_blocker() fails -- which

happens during umount -- the request is aborted before submission: the

already-collected folios are only redirtied and unlocked, so

writepages_finish() never runs and the claim is leaked.

redirty_page_for_writepage() -> folio_redirty_for_writepage() ->

filemap_dirty_folio() sets PG_dirty directly and does not go through

->dirty_folio, so ceph_dirty_folio() is not re-entered to rebalance it.

Because every subsequent writeback also fails the osd_stopping_blocker,

i_wrbuffer_ref neve

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References