# CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() > A race condition in the Linux kernel Ceph client allows a use-after-free, potentially leading to system crashes or arbitrary code execution. - **Severity:** Critical 9.8 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`) - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 16 Dec 2025 - **Updated:** 5 Aug 2026 - **Also known as:** ALSA-2026:0786, AZL-72607, BELL-CVE-2025-68285, DEBIAN-CVE-2025-68285, GHSA-v24j-9ghx-7rf2, RHSA-2026:0786, RHSA-2026:1820, RHSA-2026:2096, RHSA-2026:2109, RHSA-2026:2115, RHSA-2026:2127, RHSA-2026:2446, RHSA-2026:2557, RHSA-2026:2558, RLSA-2026:0786, ROOT-OS-DEBIAN-12-CVE-2025-68285, ROOT-OS-DEBIAN-13-CVE-2025-68285, ROOT-OS-UBUNTU-2204-CVE-2025-68285, ROOT-OS-UBUNTU-2404-CVE-2025-68285, UBUNTU-CVE-2025-68285 ## What is CVE-2025-68285? CVE-2025-68285 is a critical use after free vulnerability in Linux, published on 16 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim. ### Official description In the Linux kernel, the following vulnerability has been resolved: libceph: fix potential use-after-free in have_mon_and_osd_map() The wait loop in __ceph_open_session() can race with the client receiving a new monmap or osdmap shortly after the initial map is received. Both ceph_monc_handle_map() and handle_one_map() install a new map immediately after freeing the old one kfree(monc->monmap); monc->monmap = monmap; ceph_osdmap_destroy(osdc->osdmap); osdc->osdmap = newmap; under client->monc.mutex and client->osdc.lock respectively, but because neither is taken in have_mon_and_osd_map() it's possible for client->monc.monmap->epoch and client->osdc.osdmap->epoch arms in client->monc.monmap && client->monc.monmap->epoch && client->osdc.osdmap && client->osdc.osdmap->epoch; condition to dereference an already freed map. This happens to be reproducible with generic/395 and generic/397 with KASAN enabled: BUG: KASAN: slab-use-after-free in have_mon_and_osd_map+0x56/0x70 Read of size 4 at addr ffff88811012d810 by task mount.ceph/13305 CPU: 2 UID: 0 PID: 13305 Comm: mount.ceph Not tainted 6.14.0-rc2-build2+ #1266 ... Call Trace: have_mon_and_osd_map+0x56/0x70 ceph_open_session+0x182/0x290 ceph_get_tree+0x333/0x680 vfs_get_tree+0x49/0x180 do_new_mount+0x1a3/0x2d0 path_mount+0x6dd/0x730 do_mount+0x99/0xe0 __do_sys_mount+0x141/0x180 do_syscall_64+0x9f/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e Allocated by task 13305: ceph_osdmap_alloc+0x16/0x130 ceph_osdc_init+0x27a/0x4c0 ceph_create_client+0x153/0x190 create_fs_client+0x50/0x2a0 ceph_get_tree+0xff/0x680 vfs_get_tree+0x49/0x180 do_new_mount+0x1a3/0x2d0 path_mount+0x6dd/0x730 do_mount+0x99/0xe0 __do_sys_mount+0x141/0x180 do_syscall_64+0x9f/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 9475: kfree+0x212/0x290 handle_one_map+0x23c/0x3b0 ceph_osdc_handle_map+0x3c9/0x590 mon_dispatch+0x655/0x6f0 ceph_con_process_message+0xc3/0xe0 ceph_con_v1_try_read+0x614/0x760 ceph_con_workfn+0x2de/0x650 process_one_work+0x486/0x7c0 process_scheduled_works+0x73/0x90 worker_thread+0x1c8/0x2a0 kthread+0x2ec/0x300 ret_from_fork+0x24/0x40 ret_from_fork_asm+0x1a/0x30 Rewrite the wait loop to check the above condition directly with client->monc.mutex and client->osdc.lock taken as appropriate. While at it, improve the timeout handling (previously mount_timeout could be exceeded in case wait_event_interruptible_timeout() slept more than once) and access client->auth_err under client->monc.mutex to match how it's set in finish_auth(). monmap_show() and osdmap_show() now take the respective lock before accessing the map as well. ## Which versions are affected by CVE-2025-68285? | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `kernel-abi-stablelists` | AlmaLinux:10 | All versions | 6.12.0-124.28.1.el10_1 | | `kernel-doc` | AlmaLinux:10 | All versions | 6.12.0-124.28.1.el10_1 | | `kernel` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-64k` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-64k-core` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-64k-debug` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-64k-debug-core` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-64k-debug-debuginfo` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-64k-debug-devel` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-64k-debug-devel-matched` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-64k-debug-modules` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-64k-debug-modules-core` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-64k-debug-modules-extra` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-64k-debuginfo` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-64k-devel` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-64k-devel-matched` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-64k-modules` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-64k-modules-core` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-64k-modules-extra` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-abi-stablelists` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-core` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-debug` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-debug-core` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-debug-debuginfo` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-debug-devel` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-debug-devel-matched` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-debug-modules` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-debug-modules-core` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-debug-modules-extra` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-debug-uki-virt` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-debuginfo` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-debuginfo-common-aarch64` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-debuginfo-common-ppc64le` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-debuginfo-common-s390x` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-debuginfo-common-x86_64` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-devel` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-devel-matched` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-doc` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-modules` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | | `kernel-modules-core` | Red Hat:enterprise_linux:10.1 | All versions | 0:6.12.0-124.28.1.el10_1 | ## How do I fix CVE-2025-68285? Apply the vendor's patch. ## Is CVE-2025-68285 being exploited? There is no known exploitation of CVE-2025-68285 in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2025-68285 and fix it if it is affected. What it is: CVE-2025-68285 is a critical use after free vulnerability in Linux, published on 16 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim. Exploitation: There is no known exploitation of CVE-2025-68285 in the wild and no public exploit code. Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page. Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2025-68285/ (Markdown: https://insights.sbomify.com/CVE-2025-68285/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2025-68285 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-68285 - OSV: https://osv.dev/vulnerability/CVE-2025-68285 --- From sbomify Insights: https://insights.sbomify.com/CVE-2025-68285/ Summaries are generated and may contain mistakes; the official description above is the record.