CVE-2026-68153
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel's libceph module, debugfs files were removed after the monitor client teardown, potentially leading to a use-after-free. The fix removes debugfs files before stopping the OSD and monitor clients.
Risk Assessment
A concurrent read of a debugfs file can access freed memory, potentially leading to system crash or information disclosure.
Recommendation
Update the Linux kernel and restrict access to debugfs in production environments.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: libceph: remove debugfs files before client teardown ceph_destroy_client() tears down the monitor client before removing the per-client debugfs files. A concurrent read of the monmap debugfs file can enter monmap_show() after ceph_monc_stop() has freed monc->monmap, triggering a use-after-free. Remove the debugfs files before stopping the OSD and monitor clients. debugfs_remove() drains active handlers and prevents new accesses, so the debugfs callbacks can no longer race the rest of client teardown.