What is the CVSS score of EUVD-2026-55539?

EUVD-2026-55539 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-55539?

CVE-2026-68153 affects Linux systems running Ceph storage clients, creating availability risk through kernel crashes and memory corruption.. A patch is available.

How to fix or mitigate EUVD-2026-55539?

Within 24 hours, identify all Linux systems with Ceph clients in your infrastructure and note their kernel versions. Within 7 days, apply Linux kernel security patches per vendor advisory to all identified Ceph systems, testing thoroughly in non-production environments before production deployment. Within 30 days, verify patch deployment across the entire environment through kernel version audits and ensure no unpatched Ceph clients remain in production.

Linux Kernel EUVD-2026-55539

| CVE-2026-68153 HIGH

2026-08-10 Linux

GHSA-3j44-h3h4-hxhf

Information Disclosure Linux Suse

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

AC:H overrides the NVD AC:L because successful exploitation depends on winning a narrow timing race during client teardown, not a deterministic trigger.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

4.7 MEDIUM

AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 02:33 vuln.today

CVSS changed

Aug 13, 2026 - 23:37 NVD

7.8 (HIGH)

Patch available

Aug 10, 2026 - 14:18 EUVD

CVE Published

Aug 10, 2026 - 11:59 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 10, 2026 - 11:59 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

libceph: remove debugfs files before client teardown

ceph_destroy_client() tears down the monitor client before removing the per-client debugfs files. A concurrent read of the monmap debugfs file can enter monmap_show() after ceph_monc_stop() has freed monc->monmap, triggering a use-after-free.

Remove the debugfs files before stopping the OSD and monitor clients. debugfs_remove() drains active handlers and prevents new accesses, so the debugfs callbacks can no longer race the rest of client teardown.

AnalysisAI

Use-after-free race condition in the Linux kernel's libceph subsystem allows a local low-privileged user to corrupt kernel memory during Ceph client teardown. The flaw exists because ceph_destroy_client() frees monc->monmap via ceph_monc_stop() before removing the associated debugfs entries, enabling a concurrent reader of /sys/kernel/debug/ceph/*/monmap to invoke monmap_show() on freed memory. No public exploit or CISA KEV listing exists; EPSS of 0.17% (6th percentile) confirms this remains unexploited in the wild, but the theoretical impact is kernel memory corruption or crash on any Ceph-connected Linux host.

Technical ContextAI

The affected code resides in the libceph kernel module (CPE: cpe:2.3:a:linux:linux), which implements the Ceph distributed storage client for the Linux kernel, introduced at commit 76aa844d5b2fb8c839180d3f5874e333b297e5fd (dating to Linux 2.6.34). The root cause is a classic teardown ordering error: ceph_destroy_client() invokes ceph_monc_stop(), which deallocates monc->monmap, while per-client debugfs entries remain accessible. A thread concurrently reading the monmap debugfs file can enter monmap_show() after the backing structure is freed. The fix reorders teardown to call debugfs_remove() first, which drains all active file handlers before any client state is freed - a standard mitigation for this pattern of debugfs use-after-free in kernel subsystems. Although no formal CWE is assigned in the source data, this maps to CWE-416 (Use After Free) caused by CWE-362 (Race Condition / Concurrent Execution Using Shared Resource with Improper Synchronization).

RemediationAI

The primary remediation is to upgrade to a patched kernel version: Linux 6.6.148, 6.12.101, 6.18.42, 7.1.6, or 7.2-rc5. Individual stable-tree fix commits are directly available at https://git.kernel.org/stable/c/fc1010e7e0204ece6cc0f9af4f473e9553535eab and the four related commits listed in the references. For systems that cannot be immediately patched, a practical compensating control is to restrict or unmount the debugfs filesystem (umount /sys/kernel/debug), which eliminates the read path through monmap_show() and closes the race window entirely; note that this will disable kernel debugfs-dependent tooling (perf, tracing) as a side effect. Alternatively, removing or restricting the libceph module on hosts where Ceph storage is not operationally required eliminates the attack surface entirely without impacting other kernel functions.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

EUVD-2026-55539 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-55539

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code