Linux kernel libceph: use-after-free racing a monmap or osdmap update during CephFS mount

Impact

The wait loop in __ceph_open_session() read client->monc.monmap->epoch and client->osdc.osdmap->epoch without holding monc.mutex or osdc.lock, while the receive paths free the old map and install the new one under those locks. A mount that lands while the cluster pushes a fresh monmap or osdmap can dereference a freed map - KASAN reproduces it with generic/395 and generic/397. The practical exposure is a kernel-side use-after-free on nodes that mount CephFS or use RBD via the in-kernel client, which on a GPU fleet is often every compute node that pulls datasets or checkpoints from Ceph. Triggering it needs the race to coincide with a map change, so the realistic outcome is a node crash during cluster churn rather than a controllable attack; the NVD network-reachable score is not supported by the commit message.

Who can reach it

Local - a mount of a Ceph filesystem (or kernel RBD session) that races a monmap/osdmap update. No remote authentication path is described in the record; the trigger is normal mount activity against a cluster undergoing map changes.

What to do

Pick up the stable kernel commits that rewrite the wait loop to take monc.mutex and osdc.lock (and make monmap_show/osdmap_show take them too), then drain and reboot each node onto the patched kernel. No mitigation short of a new kernel; avoiding mounts during cluster map churn only narrows the window.

References

Related entries

• Linux kernel crypto: AEAD algorithms using cra_reqsize get an uninitialized reqsize, corrupting memoryCVE-2025-68726 · Linux kernel crypto AEAD framework (request size initialization)Critical
• Linux kernel qla2xxx: wrong free of a pooled purex item on the PURLS error path corrupts memoryCVE-2025-68741 · Linux kernel qla2xxx (purex item freed with kfree instead of qla24xx_free_purex_item)Critical
• Linux kernel qla2xxx: commands leak after chip reset, and racing unmaps hit a BUG_ONCVE-2025-68745 · Linux kernel qla2xxx (command cleanup after chip reset)Critical
• Linux kernel iomap: length underflow on non-block-aligned reads returns a position past the folioCVE-2025-68794 · Linux kernel iomap (iomap_adjust_read_range block alignment)Critical
• Linux kernel (net/tls): Closing a kTLS socket cancelled the transmit work item, but the write-space callback couldCVE-2026-23240 · Linux kernel (net/tls)Critical
• Linux kernel (net/smc): An inbound SYN handled in softirq reads the smc_sock out of the listening TCP socket'sCVE-2026-23450 · Linux kernel (net/smc)Critical