The vulnerability in the Linux kernel Ceph subsystem involves a use-after-free in check_new_map() due to missing reference counting on session objects during mutex unlock sequences. Specifically, three code paths (address changed, reconnect, active transition) fail to take a reference on the session before releasing the mdsc->mutex, unlike the forced-close path which correctly does so. This allows a race condition where another thread can unregister and free the session while the original thread still accesses its mutex, leading to use-after-free. The patch adds ceph_get_mds_session() before each mutex_unlock and ceph_put_mds_session() after the corresponding mutex_lock to ensure proper reference management and prevent the UAF.

The vulnerability can cause the kernel to access freed memory, which may lead to system instability, crashes, or potential escalation of privileges depending on exploitation context. However, no known exploits in the wild have been reported. The impact is limited to systems running the affected Linux kernel with Ceph enabled and using the affected code paths.

A fix has been implemented that adds proper reference counting around mutex unlock and lock operations in the affected code paths. Users should apply the official Linux kernel patches that address CVE-2026-89654 to remediate this vulnerability. Patch status is not explicitly confirmed in the provided data; users should consult the Linux kernel vendor advisory or source repositories for the latest patched versions and apply updates accordingly.