CVE-2026-68153

A flaw was found in the Linux kernel's libceph component. During the process of tearing down a client, the monitor client is stopped before its associated debugfs files are removed. This timing issue allows a concurrent read of the monmap debugfs file to access memory that has already been freed, leading to a use-after-free vulnerability. This type of flaw can potentially lead to system instability or a denial of service.

This vulnerability is rated as Moderate impact because triggering it requires local access on a host actively utilizing kernel Ceph storage, with the blast radius limited to a denial of service. In default Red Hat Enterprise Linux installations, the debugfs filesystem hierarchy is restricted to privileged administrators, which substantially lowers the risk of unprivileged exploitation. Additionally, triggering the use-after-free requires winning a tight race condition between tearing down an active Ceph client and reading its specific debugfs entry.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.