Linux kernel libceph: use-after-free reading the monmap debugfs file during client teardown

Impact

ceph_destroy_client() stopped the monitor client - freeing monc->monmap - before removing the per-client debugfs files, so a concurrent read of the monmap file could enter monmap_show() on freed memory. GPU nodes that mount CephFS for datasets or map RBD images for checkpoints run this code every time a mount goes away. Realistically this is a node-stability bug rather than a tenant escape: debugfs is root-only on any sane configuration, so the party who can trigger it already has the privileges the UAF would buy. The cost is a panic at exactly the wrong moment - during an unmount or teardown, which is often the end of a job or a node drain.

Who can reach it

Local root, or whoever can read /sys/kernel/debug, on a node with a kernel Ceph mount, racing a read of the client's monmap file against unmount or RBD unmap. Not reachable from an unprivileged container that has no debugfs access.

What to do

Update to a stable kernel with the fix and reboot the node. Given the root-only trigger there is little reason to open an emergency window; fold it into the next scheduled kernel roll. If you run monitoring that periodically scrapes /sys/kernel/debug/ceph, that scraping is the realistic trigger - pausing it around planned unmounts is a cheap interim measure.

References

Related entries

• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-68257 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel sockmap: cork use-after-free when two threads send on the same socketCVE-2026-68284 · Linux kernel BPF sockmap (tcp_bpf_sendmsg cork handling)High
• Linux kernel (net/rds): Network-namespace teardown frees the per-netns RDS/TCP listen socket before unregistering theCVE-2026-68290 · Linux kernel (net/rds)High
• Linux kernel RDS (rds_find_bound socket lookup ignores network namespace): This is a literal cross-tenant delivery bug.CVE-2026-68335 · Linux kernel RDS (rds_find_bound socket lookup ignores network namespace)High
• Linux kernel mlx5_core MACsec offload: Deleting an offloaded MACsec RX secure channel frees the per-SC metadata_dstCVE-2026-72072 · Linux kernel mlx5_core MACsec offloadHigh
• Linux kernel bpf: fork bailout frees an uninitialized task->bpf_storage, causing UAF or hangCVE-2026-72110 · Linux kernel BPF task local storage (copy_process / free_task bailout)High