CVE-2026-68153 PUBLISHED

libceph: remove debugfs files before client teardown

Assigner: Linux
Reserved: 30.07.2026 Published: 10.08.2026 Updated: 10.08.2026

In the Linux kernel, the following vulnerability has been resolved:

libceph: remove debugfs files before client teardown

ceph_destroy_client() tears down the monitor client before removing the per-client debugfs files. A concurrent read of the monmap debugfs file can enter monmap_show() after ceph_monc_stop() has freed monc->monmap, triggering a use-after-free.

Remove the debugfs files before stopping the OSD and monitor clients. debugfs_remove() drains active handlers and prevents new accesses, so the debugfs callbacks can no longer race the rest of client teardown.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 76aa844d5b2fb8c839180d3f5874e333b297e5fd to fc1010e7e0204ece6cc0f9af4f473e9553535eab (excl.)
  • affected from 76aa844d5b2fb8c839180d3f5874e333b297e5fd to d3dc8889d39a676bf840132bd5c5c48cb0daba23 (excl.)
  • affected from 76aa844d5b2fb8c839180d3f5874e333b297e5fd to 8f5a3abc54ba24dbceb14cc3a719908c4f688091 (excl.)
  • affected from 76aa844d5b2fb8c839180d3f5874e333b297e5fd to b9fedda2f628e030384228de0dafc574b7fb0c2f (excl.)
  • affected from 76aa844d5b2fb8c839180d3f5874e333b297e5fd to e4c804726c4afce3ba648b982d564f6af2cfa328 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 2.6.34 is affected
  • unaffected from 0 to 2.6.34 (excl.)
  • unaffected from 6.6.148 to 6.6.* (incl.)
  • unaffected from 6.12.101 to 6.12.* (incl.)
  • unaffected from 6.18.42 to 6.18.* (incl.)
  • unaffected from 7.1.6 to 7.1.* (incl.)
  • unaffected from 7.2-rc5 to * (incl.)

References