CVE-2023-53867

A use-after-free vulnerability was found in the Linux kernel's Ceph filesystem client. When iterating over session caps in ceph_iterate_session_caps(), the session->s_cap_lock is released temporarily, allowing another thread to remove the cap. If the cap is freed while the iteration continues, subsequent callback functions access stale memory, causing a use-after-free condition and potential kernel crash.

This flaw affects systems using CephFS (Ceph filesystem) mounts. The race condition occurs during cap trimming operations when multiple threads interact with the same Ceph session. Exploitation requires concurrent operations on CephFS mounts, making it timing-dependent but potentially triggerable under normal workloads with multiple processes accessing the same filesystem.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.