EUVD-2026-80598
GHSA-pccj-hx6x-mqg3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Crash originates from a local open() racing MDS session reopen, so AV:L/AC:H/PR:L; impact is a kernel-panic DoS (A:H) with only marginal freed-memory read (I:L), no confirmed leak (C:N).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ceph: lock mutex in ceph_mds_check_access()
MDS session OPEN handling replaces mdsc->s_cap_auths under mdsc->mutex, freeing the previous array and its strings.
ceph_mds_check_access() traverses this array without holding the mutex. A concurrent session reopen can therefore free the array while it is being inspected, resulting in a use-after-free like this:
Unable to handle kernel paging request at virtual address 003aaad64b2c8bb9 [...] Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 56 UID: 2953037534 PID: 1253231 Comm: php-cgi8.4 Not tainted 6.18.45-i2-ampere #1146 NONE [..] pc : ceph_mds_check_access+0xd4/0x550 lr : ceph_mds_check_access+0xc8/0x550 [...] Call trace: ceph_mds_check_access+0xd4/0x550 (P) ceph_atomic_open+0x138/0xbe8 path_openat+0xa24/0xfa8 do_filp_open+0x94/0x158 do_sys_openat2+0x88/0xf8
AnalysisAI
A use-after-free race in the Linux kernel CephFS client allows a local process to crash the kernel while opening a file on an in-kernel CephFS mount, with a secondary integrity impact on the access-check result. The bug lives in ceph_mds_check_access(), which walks the mdsc->s_cap_auths array without holding mdsc->mutex, so a concurrent MDS session OPEN (reopen) that replaces and frees that array under the mutex can free the strings mid-traversal - the oops trace shows ceph_mds_check_access reached via ceph_atomic_open and do_sys_openat2. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a mounted CephFS filesystem using the in-kernel ceph client (6.10+, where mdsc->s_cap_auths and ceph_mds_check_access() exist) with MDS cap-based access checking active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) is severely inflated and internally inconsistent with the vulnerability's own description. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches exist: upgrade the kernel to Linux 6.12.110, 6.18.51, 7.2.5, or 7.3-rc2 or later, which contain the upstream fixes at https://git.kernel.org/stable/c/a61c6ae1dae2611082b831b4aaa780878099c012, https://git.kernel.org/stable/c/729c1ff670ece6f3d4b1738365a0b2f90d487523, https://git.kernel.org/stable/c/df1a97d5313fccadb08390306d49b194fb027392 and https://git.kernel.org/stable/c/ca5bfea2045ef2eb3305cf2a9d8da549b76c37d3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Linux kernel 6.10 or later with in-kernel CephFS mounts, and confirm whether local access is restricted to trusted users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list
A kernel crash (oops) in the CephFS client can be triggered when the fscrypt filename-decryption path hands vmalloc()-ba
A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manil
A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not ve
A flaw was found in the way ceph mon handles user requests. Rated high severity (CVSS 8.1), this vulnerability is remote
An authorization bypass vulnerability was found in Ceph versions 15.2.0 before 15.2.2, where the ceph-mon and ceph-mgr d
It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attac
An issue was discovered in Ceph through 13.2.9. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitab
A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph
A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. Rated high severity
A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. Rated high sev
In Ceph before 12.2.3 and 13.x through 13.0.1, the rgw_civetweb.cc RGWCivetWeb::init_env function in radosgw doesn't han
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today