libceph: remove debugfs files before client teardown

Summary

In the Linux kernel, the following vulnerability has been resolved: libceph: remove debugfs files before client teardown ceph_destroy_client() tears down the monitor client before removing the per-client debugfs files. A concurrent read of the monmap debugfs file can enter monmap_show() after ceph_monc_stop() has freed monc->monmap, triggering a use-after-free. Remove the debugfs files before stopping the OSD and monitor clients. debugfs_remove() drains active handlers and prevents new accesses, so the debugfs callbacks can no longer race the rest of client teardown.

Timeline

1. Aug 10, 2026, 11:59 AM UTCCVE published
2. Oct 16, 2026, 3:44 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Oct 19, 2026, 8:58 PM UTCRecord last updated

Affected versions

• Linux Linux

  From 76aa844d5b2fb8c839180d3f5874e333b297e5fd · fixed in ac78549d186090ee7125d28c3a8c376573b36194; From 76aa844d5b2fb8c839180d3f5874e333b297e5fd · fixed in 463a264e9094384112a5c8b46f0a9ddaf8566904; From 76aa844d5b2fb8c839180d3f5874e333b297e5fd · fixed in fe46b7e06f14f6f94766832df309b249cb689d27; From 76aa844d5b2fb8c839180d3f5874e333b297e5fd · fixed in fc1010e7e0204ece6cc0f9af4f473e9553535eab; From 76aa844d5b2fb8c839180d3f5874e333b297e5fd · fixed in d3dc8889d39a676bf840132bd5c5c48cb0daba23; From 76aa844d5b2fb8c839180d3f5874e333b297e5fd · fixed in 8f5a3abc54ba24dbceb14cc3a719908c4f688091; From 76aa844d5b2fb8c839180d3f5874e333b297e5fd · fixed in b9fedda2f628e030384228de0dafc574b7fb0c2f; From 76aa844d5b2fb8c839180d3f5874e333b297e5fd · fixed in e4c804726c4afce3ba648b982d564f6af2cfa328

• Linux Linux

  2.6.34

• KernelLinux

  From 2.6.34 · fixed in 5.10.265; From 5.11.0 · fixed in 5.15.216; From 5.16.0 · fixed in 6.1.183; From 6.2.0 · fixed in 6.6.148; From 6.7.0 · fixed in 6.12.101; From 6.13.0 · fixed in 6.18.42; From 6.19.0 · fixed in 7.1.6

References 8