CVE-2026-68156: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68156 Overview

CVE-2026-68156 is a use-after-free vulnerability in the Linux kernel's libceph subsystem. The flaw resides in the Ceph authentication handshake path, specifically in how ceph_x_create_authorizer() caches pointers to authorizer buffers. When ceph_x_update_authorizer() rebuilds an authorizer with a newer service ticket and the rebuilt structure no longer fits in the existing buffer, the old ceph_buffer can be freed while auth->authorizer_buf still references the released memory. A subsequent msgr1 reconnect queues the stale pointer, triggering a KASAN slab-use-after-free in _copy_from_iter() during tcp_sendmsg().

Critical Impact
A network-reachable Ceph interaction can trigger kernel memory corruption via a use-after-free, enabling potential denial of service or code execution in kernel context.

Affected Products

Linux kernel builds containing the libceph module prior to the fix commits
Distributions shipping vulnerable kernels with Ceph client support enabled
Systems mounting CephFS or using RBD/RADOS over msgr1

Discovery Timeline

2026-08-10 - CVE-2026-68156 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68156

Vulnerability Analysis

The defect involves lifetime desynchronization between two data structures in the Ceph authentication code path. ceph_x_create_authorizer() populates struct ceph_auth_handshake with cached copies of au->buf->vec.iov_base and au->buf->vec.iov_len. The messenger connect logic then reads those cached values when transmitting the authorizer over the wire.

When the client receives a newer service ticket, ceph_x_update_authorizer() invokes ceph_x_build_authorizer() to reconstruct the authorizer. If the new payload exceeds the current buffer's capacity, ceph_x_build_authorizer() releases its reference to au->buf and allocates a replacement. When that reference was the final one, ceph_buffer_put() frees the old ceph_buffer along with its vec.iov_base allocation.

The auth->authorizer_buf pointer inside ceph_auth_handshake is never refreshed. It continues to reference the freed memory region. A subsequent msgr1 reconnect enqueues the dangling pointer for transmission, and tcp_sendmsg() invokes _copy_from_iter() against the released slab object, producing a use-after-free condition detectable by KASAN.

Root Cause

The root cause is missing invalidation of cached buffer pointers after a buffer replacement. The ceph_auth_handshake structure caches raw pointers into a reference-counted buffer without observing the reference count. When the underlying buffer is reallocated, the cached copies remain stale.

Attack Vector

Exploitation requires triggering an authorizer rebuild that grows beyond the existing buffer, followed by a msgr1 reconnect. This flow can occur during normal Ceph service ticket rotation. Because the freed memory is written to a socket by the kernel, an attacker who can influence adjacent slab allocations may read or corrupt kernel memory.

The vulnerability manifests in the authorizer refresh path. See the upstream kernel commits for the exact call graph and the patch that refreshes auth->authorizer_buf and auth->authorizer_buf_len after a successful rebuild.

Detection Methods for CVE-2026-68156

Indicators of Compromise

KASAN reports referencing slab-use-after-free in _copy_from_iter during tcp_sendmsg from a Ceph messenger worker
Unexpected kernel panics or oops on hosts running CephFS, RBD, or RADOS clients coinciding with service ticket rotation
Repeated msgr1 reconnect churn on Ceph client hosts logged in dmesg

Detection Strategies

Enable KASAN on test and canary systems to surface use-after-free events in the libceph code path
Correlate kernel version inventory with the fix commits listed in the upstream references to identify unpatched hosts
Monitor dmesg and journalctl -k for stack traces containing ceph_x_, _copy_from_iter, or tcp_sendmsg in proximity

Monitoring Recommendations

Aggregate kernel crash telemetry from Ceph client fleets into a central logging platform for pattern analysis
Alert on abnormal Ceph messenger reconnect rates that could indicate exploitation attempts or repeated triggering
Track kernel package versions across all Linux endpoints and servers to prioritize patch rollout

How to Mitigate CVE-2026-68156

Immediate Actions Required

Apply the upstream kernel patches referenced by the fix commits 0060ec912292, 5ecfcd5c0586, 75e82e8944ac, 937d61f86d37, and 9d37aec9ffe4
Reboot affected hosts after installing patched kernel packages so the corrected libceph module is loaded
Prioritize patching on hosts that mount CephFS or expose RBD devices reachable from untrusted networks

Patch Information

The upstream fix refreshes auth->authorizer_buf and auth->authorizer_buf_len after a successful authorizer rebuild, ensuring the messenger sends the current buffer rather than a freed pointer. Fix commits are available in the stable kernel tree: Kernel Commit 0060ec912292, Kernel Commit 5ecfcd5c0586, Kernel Commit 75e82e8944ac, Kernel Commit 937d61f86d37, and Kernel Commit 9d37aec9ffe4.

Workarounds

Restrict Ceph client usage on hosts that cannot be immediately patched by unmounting CephFS and detaching RBD devices
Segment Ceph traffic on trusted network paths to reduce exposure while patch rollout proceeds
Where feasible, prefer msgr2 configurations and monitor for reconnect events tied to ticket rotation

bash

# Verify running kernel version and libceph module status
uname -r
modinfo libceph | grep -E '^(filename|version|srcversion):'
dmesg | grep -iE 'ceph|kasan' | tail -n 50