{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2025-68285 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2025-68285 is a critical use after free vulnerability in Linux, published on 16 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-68285 and fix it if it is affected.\n\nWhat it is: CVE-2025-68285 is a critical use after free vulnerability in Linux, published on 16 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-68285 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-68285/ (Markdown: https://insights.sbomify.com/CVE-2025-68285/index.md)","id":"CVE-2025-68285","markdown":"https://insights.sbomify.com/CVE-2025-68285/index.md","name":"CVE-2025-68285","record":{"aliases":["ALSA-2026:0786","AZL-72607","BELL-CVE-2025-68285","DEBIAN-CVE-2025-68285","GHSA-v24j-9ghx-7rf2","RHSA-2026:0786","RHSA-2026:1820","RHSA-2026:2096","RHSA-2026:2109","RHSA-2026:2115","RHSA-2026:2127","RHSA-2026:2446","RHSA-2026:2557","RHSA-2026:2558","RLSA-2026:0786","ROOT-OS-DEBIAN-12-CVE-2025-68285","ROOT-OS-DEBIAN-13-CVE-2025-68285","ROOT-OS-UBUNTU-2204-CVE-2025-68285","ROOT-OS-UBUNTU-2404-CVE-2025-68285","UBUNTU-CVE-2025-68285"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service","code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Linux kernel Ceph client","requires_auth":"none","summary":"A race condition in the Linux kernel Ceph client allows a use-after-free, potentially leading to system crashes or arbitrary code execution.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":9.8,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix potential use-after-free in have_mon_and_osd_map()\n\nThe wait loop in __ceph_open_session() can race with the client\nreceiving a new monmap or osdmap shortly after the initial map is\nreceived.  Both ceph_monc_handle_map() and handle_one_map() install\na new map immediately after freeing the old one\n\n    kfree(monc-\u003emonmap);\n    monc-\u003emonmap = monmap;\n\n    ceph_osdmap_destroy(osdc-\u003eosdmap);\n    osdc-\u003eosdmap = newmap;\n\nunder client-\u003emonc.mutex and client-\u003eosdc.lock respectively, but\nbecause neither is taken in have_mon_and_osd_map() it's possible for\nclient-\u003emonc.monmap-\u003eepoch and client-\u003eosdc.osdmap-\u003eepoch arms in\n\n    client-\u003emonc.monmap \u0026\u0026 client-\u003emonc.monmap-\u003eepoch \u0026\u0026\n        client-\u003eosdc.osdmap \u0026\u0026 client-\u003eosdc.osdmap-\u003eepoch;\n\ncondition to dereference an already freed map.  This happens to be\nreproducible with generic/395 and generic/397 with KASAN enabled:\n\n    BUG: KASAN: slab-use-after-free in have_mon_and_osd_map+0x56/0x70\n    Read of size 4 at addr ffff88811012d810 by task mount.ceph/13305\n    CPU: 2 UID: 0 PID: 13305 Comm: mount.ceph Not tainted 6.14.0-rc2-build2+ #1266\n    ...\n    Call Trace:\n    \u003cTASK\u003e\n    have_mon_and_osd_map+0x56/0x70\n    ceph_open_session+0x182/0x290\n    ceph_get_tree+0x333/0x680\n    vfs_get_tree+0x49/0x180\n    do_new_mount+0x1a3/0x2d0\n    path_mount+0x6dd/0x730\n    do_mount+0x99/0xe0\n    __do_sys_mount+0x141/0x180\n    do_syscall_64+0x9f/0x100\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\n    \u003c/TASK\u003e\n\n    Allocated by task 13305:\n    ceph_osdmap_alloc+0x16/0x130\n    ceph_osdc_init+0x27a/0x4c0\n    ceph_create_client+0x153/0x190\n    create_fs_client+0x50/0x2a0\n    ceph_get_tree+0xff/0x680\n    vfs_get_tree+0x49/0x180\n    do_new_mount+0x1a3/0x2d0\n    path_mount+0x6dd/0x730\n    do_mount+0x99/0xe0\n    __do_sys_mount+0x141/0x180\n    do_syscall_64+0x9f/0x100\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n    Freed by task 9475:\n    kfree+0x212/0x290\n    handle_one_map+0x23c/0x3b0\n    ceph_osdc_handle_map+0x3c9/0x590\n    mon_dispatch+0x655/0x6f0\n    ceph_con_process_message+0xc3/0xe0\n    ceph_con_v1_try_read+0x614/0x760\n    ceph_con_workfn+0x2de/0x650\n    process_one_work+0x486/0x7c0\n    process_scheduled_works+0x73/0x90\n    worker_thread+0x1c8/0x2a0\n    kthread+0x2ec/0x300\n    ret_from_fork+0x24/0x40\n    ret_from_fork_asm+0x1a/0x30\n\nRewrite the wait loop to check the above condition directly with\nclient-\u003emonc.mutex and client-\u003eosdc.lock taken as appropriate.  While\nat it, improve the timeout handling (previously mount_timeout could be\nexceeded in case wait_event_interruptible_timeout() slept more than\nonce) and access client-\u003eauth_err under client-\u003emonc.mutex to match\nhow it's set in finish_auth().\n\nmonmap_show() and osdmap_show() now take the respective lock before\naccessing the map as well.","ecosystems":["AlmaLinux:10","Red Hat:enterprise_linux:10.1","Red Hat:enterprise_linux:8::baseos","Red Hat:enterprise_linux:9::baseos","Red Hat:rhel_e4s:8.6::baseos","Red Hat:rhel_e4s:8.8::baseos","Red Hat:rhel_e4s:9.0::baseos","Red Hat:rhel_e4s:9.2::baseos","Red Hat:rhel_eus:9.4::baseos","Red Hat:rhel_eus:9.6::baseos","Rocky Linux:10"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"libceph: fix potential use-after-free in have_mon_and_osd_map()","id":"CVE-2025-68285","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2025"},"n_packages":173,"n_references":7,"next":{"headline":"drm/amd/display: Check NULL before accessing","id":"CVE-2025-68286"},"packages":[{"ecosystem":"AlmaLinux:10","fixed":["6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-abi-stablelists","purl":"pkg:rpm/almalinux/kernel-abi-stablelists","source":"ALSA-2026:0786"},{"ecosystem":"AlmaLinux:10","fixed":["6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-doc","purl":"pkg:rpm/almalinux/kernel-doc","source":"ALSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel","purl":"pkg:rpm/redhat/kernel","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-64k","purl":"pkg:rpm/redhat/kernel-64k","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-core","purl":"pkg:rpm/redhat/kernel-64k-core","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-debug","purl":"pkg:rpm/redhat/kernel-64k-debug","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-debug-core","purl":"pkg:rpm/redhat/kernel-64k-debug-core","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-debug-debuginfo","purl":"pkg:rpm/redhat/kernel-64k-debug-debuginfo","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-debug-devel","purl":"pkg:rpm/redhat/kernel-64k-debug-devel","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-debug-devel-matched","purl":"pkg:rpm/redhat/kernel-64k-debug-devel-matched","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-debug-modules","purl":"pkg:rpm/redhat/kernel-64k-debug-modules","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-debug-modules-core","purl":"pkg:rpm/redhat/kernel-64k-debug-modules-core","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-debug-modules-extra","purl":"pkg:rpm/redhat/kernel-64k-debug-modules-extra","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-debuginfo","purl":"pkg:rpm/redhat/kernel-64k-debuginfo","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-devel","purl":"pkg:rpm/redhat/kernel-64k-devel","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-devel-matched","purl":"pkg:rpm/redhat/kernel-64k-devel-matched","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-modules","purl":"pkg:rpm/redhat/kernel-64k-modules","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-modules-core","purl":"pkg:rpm/redhat/kernel-64k-modules-core","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-64k-modules-extra","purl":"pkg:rpm/redhat/kernel-64k-modules-extra","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-abi-stablelists","purl":"pkg:rpm/redhat/kernel-abi-stablelists","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-core","purl":"pkg:rpm/redhat/kernel-core","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-debug","purl":"pkg:rpm/redhat/kernel-debug","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-debug-core","purl":"pkg:rpm/redhat/kernel-debug-core","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-debug-debuginfo","purl":"pkg:rpm/redhat/kernel-debug-debuginfo","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-debug-devel","purl":"pkg:rpm/redhat/kernel-debug-devel","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-debug-devel-matched","purl":"pkg:rpm/redhat/kernel-debug-devel-matched","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-debug-modules","purl":"pkg:rpm/redhat/kernel-debug-modules","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-debug-modules-core","purl":"pkg:rpm/redhat/kernel-debug-modules-core","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-debug-modules-extra","purl":"pkg:rpm/redhat/kernel-debug-modules-extra","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-debug-uki-virt","purl":"pkg:rpm/redhat/kernel-debug-uki-virt","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-debuginfo","purl":"pkg:rpm/redhat/kernel-debuginfo","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-debuginfo-common-aarch64","purl":"pkg:rpm/redhat/kernel-debuginfo-common-aarch64","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-debuginfo-common-ppc64le","purl":"pkg:rpm/redhat/kernel-debuginfo-common-ppc64le","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-debuginfo-common-s390x","purl":"pkg:rpm/redhat/kernel-debuginfo-common-s390x","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-debuginfo-common-x86_64","purl":"pkg:rpm/redhat/kernel-debuginfo-common-x86_64","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-devel","purl":"pkg:rpm/redhat/kernel-devel","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-devel-matched","purl":"pkg:rpm/redhat/kernel-devel-matched","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-doc","purl":"pkg:rpm/redhat/kernel-doc","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-modules","purl":"pkg:rpm/redhat/kernel-modules","source":"RHSA-2026:0786"},{"ecosystem":"Red Hat:enterprise_linux:10.1","fixed":["0:6.12.0-124.28.1.el10_1"],"introduced":["0"],"last_affected":[],"package":"kernel-modules-core","purl":"pkg:rpm/redhat/kernel-modules-core","source":"RHSA-2026:0786"}],"prev":{"headline":"libceph: prevent potential out-of-bounds writes in handle_auth_session_key()","id":"CVE-2025-68284"},"products":["Linux"],"published":"2025-12-16","related":[],"sources":[{"class":"attribution","licence":"MIT","name":"AlmaLinux","prefix":"ALSA"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHSA"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-05","vendors":["Linux"]},"summary":"A race condition in the Linux kernel Ceph client allows a use-after-free, potentially leading to system crashes or arbitrary code execution.","url":"https://insights.sbomify.com/CVE-2025-68285/"}