Ceph client UAF fixes stall after maintainer rejection

A set of Linux kernel patches that close use-after-free bugs and a session teardown race in the Ceph MDS client, including a fix for CVE-2026-89654, have not landed in mainline weeks after review, after Red Hat maintainer Alex Markuze rejected the series and author Max Kellermann said he has stopped sending further Ceph work.

Kellermann's changes address races when an MDS session is closed or when the client processes a new MDS map. Closing a session unregistered it before its capabilities were torn down, so concurrent I/O could open a fresh session for the same rank, attach old caps to it, and hit a kernel BUG when the old session was cleaned up. Separately, check_new_map could keep using a session or map after concurrent teardown freed them. CVE-2026-89654 covers a use-after-free in that path that an earlier fix left incomplete. Kellermann reports he could trigger the close race reliably by delaying teardown under load.

Ceph client co-maintainer Xiubo Li reviewed the series and eventually gave a Reviewed-by after clarifying one shutdown path. Huawei engineer Chen Yuxi later asked for progress, noting downstream kernels track the CVE and that the patches were still missing from both the testing branch and mainline.

Kellermann replied that Markuze had rejected the set and never answered follow-ups, and that an internal fork now carries 67 Ceph patches that were "either rejected or ignored," including another security fix. "I'm not submitting them," he wrote, pointing to earlier friction on the Ceph development list.

Markuze then said Xiubo's ack was "good enough for me," that Xiubo is back on the maintainers list, and asked Kellermann to resend because the tree had diverged since September. He invited further patches that solve real problems.