Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2025-68285— libceph: fix potential use-after-free in have_mon_and_osd_map()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于have_mon_and_osd_map存在释放后重用问题，可能导致系统不稳定。

CVSS 9.8 · Critical EPSS 0.57% · P45

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 16

VendorProduct Version RangeStatus
Linux Linux 6822d00b5462e7a9dfa11dcc60cc25823a2107c5< bb4910c5fd436701faf367e1b5476a5a6d2aff1c affected
6822d00b5462e7a9dfa11dcc60cc25823a2107c5< 05ec43e9a9de67132dc8cd3b22afef001574947f affected
6822d00b5462e7a9dfa11dcc60cc25823a2107c5< 7c8ccdc1714d9fabecd26e1be7db1771061acc6e affected
6822d00b5462e7a9dfa11dcc60cc25823a2107c5< 183ad6e3b651e8fb0b66d6a2678f4b80bfbba092 affected
6822d00b5462e7a9dfa11dcc60cc25823a2107c5< e08021b3b56b2407f37b5fe47b654be80cc665fb affected
6822d00b5462e7a9dfa11dcc60cc25823a2107c5< 3fc43120b22a3d4f1fbeff56a35ce2105b6a5683 affected
6822d00b5462e7a9dfa11dcc60cc25823a2107c5< 076381c261374c587700b3accf410bdd2dba334e affected
2.6.35 affected
… +8 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-68285

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
libceph: fix potential use-after-free in have_mon_and_osd_map()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: libceph: fix potential use-after-free in have_mon_and_osd_map() The wait loop in __ceph_open_session() can race with the client receiving a new monmap or osdmap shortly after the initial map is received. Both ceph_monc_handle_map() and handle_one_map() install a new map immediately after freeing the old one kfree(monc->monmap); monc->monmap = monmap; ceph_osdmap_destroy(osdc->osdmap); osdc->osdmap = newmap; under client->monc.mutex and client->osdc.lock respectively, but because neither is taken in have_mon_and_osd_map() it's possible for client->monc.monmap->epoch and client->osdc.osdmap->epoch arms in client->monc.monmap && client->monc.monmap->epoch && client->osdc.osdmap && client->osdc.osdmap->epoch; condition to dereference an already freed map. This happens to be reproducible with generic/395 and generic/397 with KASAN enabled: BUG: KASAN: slab-use-after-free in have_mon_and_osd_map+0x56/0x70 Read of size 4 at addr ffff88811012d810 by task mount.ceph/13305 CPU: 2 UID: 0 PID: 13305 Comm: mount.ceph Not tainted 6.14.0-rc2-build2+ #1266 ... Call Trace: <TASK> have_mon_and_osd_map+0x56/0x70 ceph_open_session+0x182/0x290 ceph_get_tree+0x333/0x680 vfs_get_tree+0x49/0x180 do_new_mount+0x1a3/0x2d0 path_mount+0x6dd/0x730 do_mount+0x99/0xe0 __do_sys_mount+0x141/0x180 do_syscall_64+0x9f/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> Allocated by task 13305: ceph_osdmap_alloc+0x16/0x130 ceph_osdc_init+0x27a/0x4c0 ceph_create_client+0x153/0x190 create_fs_client+0x50/0x2a0 ceph_get_tree+0xff/0x680 vfs_get_tree+0x49/0x180 do_new_mount+0x1a3/0x2d0 path_mount+0x6dd/0x730 do_mount+0x99/0xe0 __do_sys_mount+0x141/0x180 do_syscall_64+0x9f/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 9475: kfree+0x212/0x290 handle_one_map+0x23c/0x3b0 ceph_osdc_handle_map+0x3c9/0x590 mon_dispatch+0x655/0x6f0 ceph_con_process_message+0xc3/0xe0 ceph_con_v1_try_read+0x614/0x760 ceph_con_workfn+0x2de/0x650 process_one_work+0x486/0x7c0 process_scheduled_works+0x73/0x90 worker_thread+0x1c8/0x2a0 kthread+0x2ec/0x300 ret_from_fork+0x24/0x40 ret_from_fork_asm+0x1a/0x30 Rewrite the wait loop to check the above condition directly with client->monc.mutex and client->osdc.lock taken as appropriate. While at it, improve the timeout handling (previously mount_timeout could be exceeded in case wait_event_interruptible_timeout() slept more than once) and access client->auth_err under client->monc.mutex to match how it's set in finish_auth(). monmap_show() and osdmap_show() now take the respective lock before accessing the map as well.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于have_mon_and_osd_map存在释放后重用问题，可能导致系统不稳定。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 6822d00b5462e7a9dfa11dcc60cc25823a2107c5 ~ bb4910c5fd436701faf367e1b5476a5a6d2aff1c -
Linux Linux 2.6.35 -

II. Public POCs for CVE-2025-68285

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-68285

请登录查看更多情报信息。

Other References for CVE-2025-68285 (7)

Same Patch Batch · Linux · 2025-12-16 · 157 CVEs total

CVE-2025-68301 9.8 CRITICAL net: atlantic: fix fragment overflow handling in RX path
CVE-2025-68315 9.8 CRITICAL f2fs: fix to detect potential corrupted nid in free_nid_list
CVE-2025-68263 9.8 CRITICAL ksmbd: ipc: fix use-after-free in ipc_msg_send_request
CVE-2025-68284 9.8 CRITICAL libceph: prevent potential out-of-bounds writes in handle_auth_session_key()
CVE-2025-68192 9.8 CRITICAL net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
CVE-2025-40350 9.8 CRITICAL net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ
CVE-2025-68226 8.8 HIGH smb: client: fix incomplete backport in cfids_invalidation_worker()
CVE-2025-68304 8.8 HIGH Bluetooth: hci_core: lookup hci_conn on RX path on protocol side
CVE-2025-68255 8.8 HIGH staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
CVE-2025-68256 8.8 HIGH staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser
CVE-2025-40362 8.8 HIGH ceph: fix multifs mds auth caps issue
CVE-2025-68314 8.8 HIGH drm/msm: make sure last_fence is always updated
CVE-2025-68250 8.2 HIGH hung_task: fix warnings caused by unaligned lock pointers
CVE-2025-68171 7.8 HIGH x86/fpu: Ensure XFD state on signal delivery
CVE-2025-68174 7.8 HIGH amd/amdkfd: enhance kfd process check in switch partition
CVE-2025-68175 7.8 HIGH media: nxp: imx8-isi: Fix streaming cleanup on release
CVE-2025-68260 7.8 HIGH rust_binder: fix race condition on death_list
CVE-2025-68179 7.8 HIGH s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP
CVE-2025-68234 7.8 HIGH io_uring/cmd_net: fix wrong argument types for skb_queue_splice()
CVE-2025-68189 7.8 HIGH drm/msm: Fix GEM free for imported dma-bufs

Showing top 20 of 157 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-68285

No comments yet

Leave a comment