EUVD-2026-76567
GHSA-67r3-hj2c-67vv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reachable only via a malicious/MITM MDS on a mounted CephFS client (AV:A, PR:L) and gated on winning a tight race (AC:H); impact is a client crash/corruption, so A:H with C/I:N.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
list_for_each_entry() iterates ci->i_cap_flush_list but drops i_ceph_lock to send cap messages. During the unlock window, handle_cap_flush_ack() can acquire i_ceph_lock, detach cf entries with tid <= flush_tid from the list, release i_ceph_lock, and free them via ceph_free_cap_flush() outside any lock. When the original thread reacquires i_ceph_lock and the for-loop macro advances via cf = list_next_entry(cf, i_list), it dereferences cf->i_list.next on freed memory.
The race timeline:
__kick_flushing_caps() handle_cap_flush_ack() ----------------------- ----------------------- holds i_ceph_lock <--- iterates to cf (tid=10) prepares FLUSH message drops i_ceph_lock <--- __send_cap() ── FLUSH(tid=10) MDS sends FLUSH_ACK(tid=10) ---> acquires i_ceph_lock cf->tid(10) <= flush_tid(10), detaches cf from i_cap_flush_list drops i_ceph_lock ceph_free_cap_flush(cf) <- frees it! acquires i_ceph_lock <--- for-loop advances: cf = list_next_entry(cf, i_list) -- UAF on freed cf->i_list.next
The cf was just sent by __kick_flushing_caps itself via __send_cap(). The MDS may respond with FLUSH_ACK quickly enough that handle_cap_flush_ack() frees cf before __kick_flushing_caps can finish the iteration.
Fix by converting to a manual while loop: save the next pointer under i_ceph_lock before dropping it, then use the saved pointer after reacquiring, so the potentially-freed cf is never accessed again.
AnalysisAI
Use-after-free in the Linux kernel CephFS client (__kick_flushing_caps) lets a race between cap-flush transmission and FLUSH_ACK handling corrupt kernel memory on a mounted CephFS client. Because the iterator drops i_ceph_lock to send cap messages, a fast-responding MDS can cause handle_cap_flush_ack() to detach and free the current cap-flush entry before the loop advances, dereferencing freed memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an actively mounted CephFS filesystem on the victim host and a malicious, compromised, or MITM-positioned Ceph MDS that can send a FLUSH_ACK with tid <= the just-sent flush_tid quickly enough to hit the unlock window in __kick_flushing_caps(). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) substantially overstates real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1 (or a later distro kernel that backports commits 2701431aa3cc / fe46746087b5 / 2dba24dcd505 / 7af4c4f01305), then reboot. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems with mounted CephFS filesystems and document their kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today