CVE-2025-68285: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68285 is a use-after-free vulnerability in the Linux kernel's libceph subsystem, specifically in the have_mon_and_osd_map() function. It arises from a race condition during the wait loop in __ceph_open_session(), where concurrent monmap or osdmap updates can free and replace maps while they are being dereferenced without proper locking. The vulnerability was published on December 16, 2025, and affects Linux kernel versions with Ceph client support, as well as downstream products including IBM Netezza Appliance and Microsoft Azure Linux 3 (AZL3 kernel 6.6.117.1-1). It carries a CVSS v3.1 base score of 7.0 (High) (Microsoft MSRC, IBM Advisory).

The root cause is a race condition (CWE-416: Use After Free) in have_mon_and_osd_map(), which checks client->monc.monmap->epoch and client->osdc.osdmap->epoch without holding client->monc.mutex or client->osdc.lock. Both ceph_monc_handle_map() and handle_one_map() free the old map and install a new one under their respective locks, but have_mon_and_osd_map() can dereference the already-freed pointer between the kfree() and the pointer reassignment. The bug is reproducible with xfstests generic/395 and generic/397 with KASAN enabled, producing a BUG: KASAN: slab-use-after-free in have_mon_and_osd_map+0x56/0x70 during mount.ceph operations. The fix rewrites the wait loop to properly acquire both locks before checking map epoch values (Microsoft MSRC).

A local unprivileged attacker (requiring only low privileges) can trigger the race condition to dereference freed kernel memory, potentially causing a kernel crash (denial of service) or achieving privilege escalation. Successful exploitation carries high confidentiality, integrity, and availability impact, as arbitrary kernel memory corruption can lead to full system compromise. The vulnerability is scoped to the local system and affects any Linux system with the Ceph client (libceph) loaded and active, including cloud and storage environments using CephFS mounts (Microsoft MSRC).

Apply the patched Linux kernel version provided by your distribution. Upstream fixes are available via kernel.org commits (e.g., 3fc43120b22a, 05ec43e9a9de, 7c8ccdc1714d, 183ad6e3b651). Distribution-specific patches have been released by Red Hat (RHSA-2026:0444, RHSA-2026:0489, RHSA-2026:0532, and others), Ubuntu (USN-8094-1 through USN-8094-5, USN-8096-2, USN-8116-1, USN-8152-1), SUSE, Debian (DLA-4436-1), Amazon Linux 2, Oracle Linux, AlmaLinux, and Rocky Linux. IBM has also issued an advisory for Netezza Appliance. As a temporary workaround where patching is not immediately possible, avoid mounting CephFS on affected systems or restrict local user access to systems with active Ceph mounts (Microsoft MSRC, IBM Advisory, Red Hat RHSA-2026:0444, Ubuntu USN-8094-1).