CVE-2025-68285

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

libceph: fix potential use-after-free in have_mon_and_osd_map()

The wait loop in __ceph_open_session() can race with the client

receiving a new monmap or osdmap shortly after the initial map is

received. Both ceph_monc_handle_map() and handle_one_map() install

a new map immediately after freeing the old one

kfree(monc->monmap);

monc->monmap = monmap;

ceph_osdmap_destroy(osdc->osdmap);

osdc->osdmap = newmap;

under client->monc.mutex and client->osdc.lock respectively, but

because neither is taken in have_mon_and_osd_map() it's possible for

client->monc.monmap->epoch and client->osdc.osdmap->epoch arms in

client->monc.monmap && client->monc.monmap->epoch &&

client->osdc.osdmap && client->osdc.osdmap->epoch;

condition to dereference an already freed map. This happens to be

reproducible with generic/395 and generic/397 with KASAN enabled:

BUG: KASAN: slab-use-after-free in have_mon

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References