CVE-2025-68285
A flaw in the Linux kernel's Ceph component allows for a 'use-after-free' error. This occurs when the system tries to access memory that has already been released, specifically during the handling of monitor or OSD maps.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users running the Linux kernel with the Ceph (libceph) module enabled.
Real-world impact
An attacker could potentially cause a system crash or execute arbitrary code by exploiting the race condition that leads to memory corruption.
Why this severity
This is a critical vulnerability because it can be exploited remotely over a network without authentication, allowing an attacker to compromise the confidentiality, integrity, and availability of the system.
What to do about it
- 01Update the Linux kernel to the version containing the fix for libceph use-after-free in have_mon_and_osd_map().
NVD-referenced vendor advisory
Timeline
- Dec 16, 2025 · Dec 16, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 6d agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 6d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/05ec43e9a9de67132d…
- git.kernel.org/stable/c/076381c261374c5877…
- git.kernel.org/stable/c/183ad6e3b651e8fb0b…
- git.kernel.org/stable/c/3fc43120b22a3d4f1f…
- git.kernel.org/stable/c/7c8ccdc1714d9fabec…
- git.kernel.org/stable/c/bb4910c5fd436701fa…
- git.kernel.org/stable/c/e08021b3b56b2407f3…