External risk intelligence

Linux Kernel libceph Use-After-Free Vulnerability in have_mon_and_osd_map

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-68285

This vulnerability is located deep within the Linux kernel's Ceph file system client implementation. It concerns internal race conditions during file system mounting or session management. It is not a network-exposed service, API, or web application, but rather an internal kernel-level mechanism that is not reachable from the public internet.

Use After Free

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability resides within the Linux kernel, specifically in how the Ceph distributed file system client manages its internal maps during session establishment. It could lead to a system crash if a specific race condition occurs during operations involving these maps, impacting the stability of systems using this component.

Kernel issue affects Ceph file system client stability.
Understandable as a core system function risk.
Confirm relevance and exposure of affected systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit a race condition within the Linux kernel's Ceph client. This occurs when a file system session is being opened, and the system rapidly receives new map information. If the timing is just right, the system may try to use outdated or already freed data structures, leading to a use-after-free vulnerability.

Entry condition: Client attempting to open a Ceph file system session.
Trigger point: Rapidly receiving new map data during session opening.
Resulting risk: Kernel memory corruption and potential system instability.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact the integrity of data stored on a Linux system using the Ceph file system. When the system attempts to establish or re-establish a connection with the Ceph cluster, a race condition may occur during the handling of network maps. This race condition could lead to the system referencing memory that has already been freed, potentially causing system instability or data corruption.

System data and service integrity at risk.
A race condition during map handling.
Potential for system instability and data corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides within the Linux kernel's Ceph client, specifically affecting the handling of network maps during session establishment. Ownership likely falls to infrastructure or platform teams responsible for the kernel and Ceph deployments, with coordination from security teams. The first practical step is to identify all systems running the affected kernel version with Ceph configured, assess their exposure and criticality, and then plan remediation during a maintenance window.

Own by kernel/infrastructure teams.
Verify Ceph deployments and kernel versions.
Plan for kernel updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the libceph component in the Linux kernel?

libceph is a foundational part of the Linux kernel that enables the operating system to interact with the Ceph distributed file system. It manages communication and data organization between a local client and the remote Ceph storage cluster. Administrators use this component when configuring Linux servers to mount Ceph storage volumes for shared file access or high-performance data storage requirements.

What does the use-after-free weakness mean for CVE-2025-68285?

A use-after-free occurs when the system attempts to access a specific memory location after it has already been released or 'freed' for other uses. In this case, the kernel's Ceph client may mistakenly reference memory addresses belonging to old network maps. This results in memory corruption, which typically causes the operating system to crash or behave unpredictably due to the invalid data access.

How is this race condition triggered?

The vulnerability is triggered during the opening of a Ceph file system session. Specifically, it occurs when a race condition exists between the kernel trying to establish a session and the rapid arrival of updated network map data. If the system is not actively mounting or re-establishing a connection to a Ceph cluster, this specific code path is not exercised, and the vulnerability cannot be triggered.

Is this vulnerability reachable from the internet?

According to Halo Surface Signal, this vulnerability is not a network-exposed service, API, or web application. Because it resides deep within an internal kernel-level mechanism for file system management, it is considered very unlikely to be reachable from the public internet. The issue concerns internal timing during local system operations rather than remote input processing.

How should I respond to CVE-2025-68285?

If you manage Linux infrastructure, your first step is to identify any systems where the Ceph file system client is actively used. Verify your kernel versions against available patches from your distribution provider. Since this requires a kernel update, coordinate with your infrastructure team to test and schedule these changes during a planned maintenance window to ensure stability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.