CVE-2026-68153
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: libceph: remove debugfs files before client teardown ceph_destroy_client() tears down the monitor client before removing the per-client debugfs files. A concurrent read of the monmap debugfs file can enter monmap_show() after ceph_monc_stop() has freed monc->monmap, triggering a use-after-free. Remove the debugfs files before stopping the OSD and monitor clients. debugfs_remove() drains active handlers and prevents new accesses, so the debugfs callbacks can no longer race the rest of client teardown.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-08-10 13:20:01.417000
Last modified
2026-10-19 21:17:55.170000
View original CVE JSON
{
"id": "CVE-2026-68153",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-08-10T13:20:01.417",
"lastModified": "2026-10-19T21:17:55.170",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: remove debugfs files before client teardown\n\nceph_destroy_client() tears down the monitor client before removing\nthe per-client debugfs files. A concurrent read of the monmap debugfs\nfile can enter monmap_show() after ceph_monc_stop() has freed\nmonc->monmap, triggering a use-after-free.\n\nRemove the debugfs files before stopping the OSD and monitor clients.\ndebugfs_remove() drains active handlers and prevents new accesses, so\nthe debugfs callbacks can no longer race the rest of client teardown."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"net/ceph/ceph_common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "76aa844d5b2fb8c839180d3f5874e333b297e5fd",
"lessThan": "ac78549d186090ee7125d28c3a8c376573b36194",
"versionType": "git",
"status": "affected"
},
{
"version": "76aa844d5b2fb8c839180d3f5874e333b297e5fd",
"lessThan": "463a264e9094384112a5c8b46f0a9ddaf8566904",
"versionType": "git",
"status": "affected"
},
{
"version": "76aa844d5b2fb8c839180d3f5874e333b297e5fd",
"lessThan": "fe46b7e06f14f6f94766832df309b249cb689d27",
"versionType": "git",
"status": "affected"
},
{
"version": "76aa844d5b2fb8c839180d3f5874e333b297e5fd",
"lessThan": "fc1010e7e0204ece6cc0f9af4f473e9553535eab",
"versionType": "git",
"status": "affected"
},
{
"version": "76aa844d5b2fb8c839180d3f5874e333b297e5fd",
"lessThan": "d3dc8889d39a676bf840132bd5c5c48cb0daba23",
"versionType": "git",
"status": "affected"
},
{
"version": "76aa844d5b2fb8c839180d3f5874e333b297e5fd",
"lessThan": "8f5a3abc54ba24dbceb14cc3a719908c4f688091",
"versionType": "git",
"status": "affected"
},
{
"version": "76aa844d5b2fb8c839180d3f5874e333b297e5fd",
"lessThan": "b9fedda2f628e030384228de0dafc574b7fb0c2f",
"versionType": "git",
"status": "affected"
},
{
"version": "76aa844d5b2fb8c839180d3f5874e333b297e5fd",
"lessThan": "e4c804726c4afce3ba648b982d564f6af2cfa328",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"net/ceph/ceph_common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "2.6.34",
"status": "affected"
},
{
"version": "0",
"lessThan": "2.6.34",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.265",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.216",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.183",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.148",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.101",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.42",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.1.6",
"lessThanOrEqual": "7.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-16T15:44:57.260747Z",
"id": "CVE-2026-68153",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/463a264e9094384112a5c8b46f0a9ddaf8566904",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8f5a3abc54ba24dbceb14cc3a719908c4f688091",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ac78549d186090ee7125d28c3a8c376573b36194",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b9fedda2f628e030384228de0dafc574b7fb0c2f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d3dc8889d39a676bf840132bd5c5c48cb0daba23",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e4c804726c4afce3ba648b982d564f6af2cfa328",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fc1010e7e0204ece6cc0f9af4f473e9553535eab",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fe46b7e06f14f6f94766832df309b249cb689d27",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}