CVE-2026-68153 Overview
CVE-2026-68153 is a use-after-free vulnerability in the Linux kernel's libceph subsystem. The flaw exists in the client teardown path, where ceph_destroy_client() stops the monitor client before removing per-client debugfs files. A concurrent read of the monmap debugfs file can enter monmap_show() after ceph_monc_stop() has already freed monc->monmap, resulting in access to freed memory.
The issue affects local users with the ability to read debugfs entries during client teardown. Exploitation could lead to kernel memory corruption, information disclosure, or privilege escalation.
Critical Impact
A race between monmap_show() and ceph_monc_stop() allows local attackers to trigger a use-after-free in the Ceph client, potentially compromising kernel memory integrity.
Affected Products
- Linux kernel libceph subsystem (Ceph client)
- Distributions shipping affected stable kernel versions prior to the fix commits
- Systems mounting CephFS or using RBD with debugfs enabled
Discovery Timeline
- 2026-08-10 - CVE-2026-68153 published to the National Vulnerability Database (NVD)
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-68153
Vulnerability Analysis
The vulnerability is a classic use-after-free race condition [CWE-416] between two code paths in the Ceph client. When a Ceph client shuts down, ceph_destroy_client() invokes ceph_monc_stop(), which frees the monitor map stored in monc->monmap. The per-client debugfs entries, including the monmap file, are removed only after this teardown step completes.
During the window between the monitor client stop and debugfs file removal, a userspace process holding an open file descriptor on the debugfs entry can invoke the monmap_show() callback. That handler dereferences monc->monmap after the structure has already been released.
Root Cause
The root cause is incorrect ordering of resource cleanup in ceph_destroy_client(). Kernel debugfs interfaces must be torn down before the data structures they expose are freed. Because debugfs_remove() drains active handlers and blocks new opens, removing the debugfs files first would eliminate the race. The original ordering violated this invariant.
Attack Vector
A local attacker with permission to read /sys/kernel/debug/ceph/*/monmap schedules a read against the debugfs entry while a Ceph client is being destroyed. Winning the race causes monmap_show() to dereference freed kernel memory. Successful exploitation requires local access and low privileges; user interaction is not required.
No public proof-of-concept exploit is currently available. Because the primitive operates on freed kernel slab memory, weaponization typically requires heap grooming to place attacker-controlled data at the freed address.
The vulnerability is described in the upstream commits referenced by the Linux stable tree. See the Kernel Git Commit 8f5a3ab and the Kernel Git Commit b9fedda for the authoritative technical details.
Detection Methods for CVE-2026-68153
Indicators of Compromise
- Kernel oops or KASAN: use-after-free reports referencing monmap_show or ceph_monc_stop in the call trace
- Unexpected crashes or panics during unmount of CephFS or teardown of RBD mappings
- Repeated reads of /sys/kernel/debug/ceph/*/monmap from non-administrative processes
Detection Strategies
- Enable KASAN in test environments to catch the use-after-free at the point of dereference
- Audit installed kernel package versions against the fixed stable release commits
- Monitor process access patterns to debugfs paths under /sys/kernel/debug/ceph/
Monitoring Recommendations
- Collect kernel ring buffer output (dmesg) and forward to a central log store for pattern matching on libceph and monmap strings
- Alert on non-root processes opening files under /sys/kernel/debug/
- Track Ceph client lifecycle events correlated with debugfs access from user processes
How to Mitigate CVE-2026-68153
Immediate Actions Required
- Update the Linux kernel to a stable release that includes the fix commits from the upstream libceph patch series
- Restrict debugfs mount permissions so only privileged administrators can read entries under /sys/kernel/debug/
- Where kernel updates cannot be deployed immediately, avoid mounting debugfs on production hosts running Ceph clients
Patch Information
The fix reorders ceph_destroy_client() to remove debugfs files before stopping the OSD and monitor clients. debugfs_remove() drains active handlers and blocks new accesses, eliminating the race with monmap_show(). The patch is available in the following upstream commits: Kernel Git Commit d3dc888, Kernel Git Commit e4c8047, and Kernel Git Commit fc1010e.
Workarounds
- Unmount or disable debugfs on hosts that do not require it: umount /sys/kernel/debug
- Tighten permissions on the debugfs mount so only root can traverse the tree: chmod 700 /sys/kernel/debug
- Where feasible, unload the ceph and libceph modules on hosts that do not currently need Ceph client functionality
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
