---
id: CVE-2026-68153
title: 'libceph: remove debugfs files before client teardown'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  libceph: remove debugfs files before client teardown

  ceph_destroy_client() tears down the monitor client before removing
  the per-client debugfs files. A concurrent rea…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 76aa844d5b2fb8c839180d3f5874e333b297e5fd <
    ac78549d186090ee7125d28c3a8c376573b36194
  - >-
    Linux >= 76aa844d5b2fb8c839180d3f5874e333b297e5fd <
    463a264e9094384112a5c8b46f0a9ddaf8566904
  - >-
    Linux >= 76aa844d5b2fb8c839180d3f5874e333b297e5fd <
    fe46b7e06f14f6f94766832df309b249cb689d27
  - >-
    Linux >= 76aa844d5b2fb8c839180d3f5874e333b297e5fd <
    fc1010e7e0204ece6cc0f9af4f473e9553535eab
  - >-
    Linux >= 76aa844d5b2fb8c839180d3f5874e333b297e5fd <
    d3dc8889d39a676bf840132bd5c5c48cb0daba23
  - >-
    Linux >= 76aa844d5b2fb8c839180d3f5874e333b297e5fd <
    8f5a3abc54ba24dbceb14cc3a719908c4f688091
  - >-
    Linux >= 76aa844d5b2fb8c839180d3f5874e333b297e5fd <
    b9fedda2f628e030384228de0dafc574b7fb0c2f
  - >-
    Linux >= 76aa844d5b2fb8c839180d3f5874e333b297e5fd <
    e4c804726c4afce3ba648b982d564f6af2cfa328
  - Linux 2.6.34
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:44:57.260747Z'
published: '2026-08-10'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:00.591Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68153'
references:
  - url: 'https://git.kernel.org/stable/c/ac78549d186090ee7125d28c3a8c376573b36194'
  - url: 'https://git.kernel.org/stable/c/463a264e9094384112a5c8b46f0a9ddaf8566904'
  - url: 'https://git.kernel.org/stable/c/fe46b7e06f14f6f94766832df309b249cb689d27'
  - url: 'https://git.kernel.org/stable/c/fc1010e7e0204ece6cc0f9af4f473e9553535eab'
  - url: 'https://git.kernel.org/stable/c/d3dc8889d39a676bf840132bd5c5c48cb0daba23'
  - url: 'https://git.kernel.org/stable/c/8f5a3abc54ba24dbceb14cc3a719908c4f688091'
  - url: 'https://git.kernel.org/stable/c/b9fedda2f628e030384228de0dafc574b7fb0c2f'
  - url: 'https://git.kernel.org/stable/c/e4c804726c4afce3ba648b982d564f6af2cfa328'
tags:
  - cve.org
epss: 0.00126
epssPercentile: 0.02029
ingestedAt: '2026-10-16T17:24:46.844Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

libceph: remove debugfs files before client teardown

ceph_destroy_client() tears down the monitor client before removing
the per-client debugfs files. A concurrent read of the monmap debugfs
file can enter monmap_show() after ceph_monc_stop() has freed
monc->monmap, triggering a use-after-free.

Remove the debugfs files before stopping the OSD and monitor clients.
debugfs_remove() drains active handlers and prevents new accesses, so
the debugfs callbacks can no longer race the rest of client teardown.

## Affected

- `Linux >= 76aa844d5b2fb8c839180d3f5874e333b297e5fd < ac78549d186090ee7125d28c3a8c376573b36194`
- `Linux >= 76aa844d5b2fb8c839180d3f5874e333b297e5fd < 463a264e9094384112a5c8b46f0a9ddaf8566904`
- `Linux >= 76aa844d5b2fb8c839180d3f5874e333b297e5fd < fe46b7e06f14f6f94766832df309b249cb689d27`
- `Linux >= 76aa844d5b2fb8c839180d3f5874e333b297e5fd < fc1010e7e0204ece6cc0f9af4f473e9553535eab`
- `Linux >= 76aa844d5b2fb8c839180d3f5874e333b297e5fd < d3dc8889d39a676bf840132bd5c5c48cb0daba23`
- `Linux >= 76aa844d5b2fb8c839180d3f5874e333b297e5fd < 8f5a3abc54ba24dbceb14cc3a719908c4f688091`
- `Linux >= 76aa844d5b2fb8c839180d3f5874e333b297e5fd < b9fedda2f628e030384228de0dafc574b7fb0c2f`
- `Linux >= 76aa844d5b2fb8c839180d3f5874e333b297e5fd < e4c804726c4afce3ba648b982d564f6af2cfa328`
- `Linux 2.6.34`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.