CVE-2026-68153

Received Received - Intake

libceph Debugfs Use-After-Free in Linux Kernel

Publication date: 2026-08-10

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: libceph: remove debugfs files before client teardown ceph_destroy_client() tears down the monitor client before removing the per-client debugfs files. A concurrent read of the monmap debugfs file can enter monmap_show() after ceph_monc_stop() has freed monc->monmap, triggering a use-after-free. Remove the debugfs files before stopping the OSD and monitor clients. debugfs_remove() drains active handlers and prevents new accesses, so the debugfs callbacks can no longer race the rest of client teardown.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-10-19

Generated

2026-11-08

AI Q&A

2026-08-10

EPSS Evaluated

2026-11-07

NVD

CVE-2026-68153

EUVD

EUVD-2026-55539

Affected Vendors & Products

Vendor	Product	Version / Range
ceph	libceph	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's Ceph client implementation. It occurs when ceph_destroy_client() removes the monitor client before cleaning up debugfs files. A concurrent read of the monmap debugfs file can trigger a use-after-free because monmap_show() tries to access monc->monmap after it has been freed by ceph_monc_stop().

Detection Guidance

This vulnerability is specific to the Linux kernel's Ceph client implementation and involves a use-after-free condition in debugfs file handling. Detection requires checking kernel logs for related errors or enabling debugfs monitoring. Commands like dmesg | grep ceph or checking /sys/kernel/debug/ceph for debugfs entries may help identify issues.

Impact Analysis

This vulnerability could allow an attacker with local access to cause a system crash or potentially execute arbitrary code with kernel privileges. It may lead to denial-of-service conditions or unauthorized access to sensitive system data.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a use-after-free issue in the Linux kernel's Ceph client debugfs handling, which could lead to system instability or crashes but does not involve data exposure or privacy violations.

Mitigation Strategies

Update the Linux kernel to a patched version where the fix has been applied. The vulnerability is resolved by removing debugfs files before client teardown, so ensure your kernel includes this change. Monitor kernel updates from your distribution vendor.

Hi! I’m here to help you understand CVE-2026-68153. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...