CVE-2023-53867
A critical bug in the Linux kernel’s Ceph module could cause a program to crash when it tries to use a freed memory block. The flaw occurs while trimming session capabilities, potentially leading to a use‑after‑free crash. The issue has been fixed in the kernel source.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users running Ceph storage, especially system administrators managing Ceph clusters.
Real-world impact
An attacker who can influence the Ceph session could trigger a crash, causing a denial of service that disrupts storage operations.
Why this severity
The CVSS score of 9.8 reflects that a local attacker can exploit the bug without authentication, leading to complete loss of confidentiality, integrity, and availability by crashing the kernel.
What to do about it
- 01Upgrade your Linux kernel to a version that includes the Ceph use‑after‑free fix.
NVD-referenced vendor advisory
Timeline
- Dec 24, 2025 · Dec 24, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 1d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.