CVE-2026-68156

What it actually does

This is a Linux kernel use-after-free in the Ceph client authentication path. The libceph cephx authorizer code caches a pointer and length for an authentication buffer, but when a newer service ticket causes the authorizer to be rebuilt, the underlying buffer can be freed and replaced without refreshing the cached pointer. On a later msgr1 reconnect, the messenger code can attempt to send data from the stale freed pointer, producing kernel memory corruption behavior such as a KASAN slab-use-after-free in _copy_from_iter() during tcp_sendmsg(). The most likely practical impact is a kernel crash or instability on systems using the in-kernel Ceph client with cephx authentication, especially during ticket refresh and reconnect conditions.

Why it matters to the business

Organizations using Linux hosts that mount or consume Ceph storage through the kernel client may face unexpected host crashes, degraded storage access, failed workloads, or service interruptions if the vulnerable code path is triggered. Because the issue is in kernel-space storage client code, disruption can affect application availability even when the Ceph cluster itself remains healthy. This issue is recently published, is not currently listed in CISA KEV, and has no provided evidence of public exploitation, but it should still be prioritized for environments that depend on CephFS, RBD, or other Ceph-backed production storage.

How an attack unfolds

An attacker would need to influence conditions under which a vulnerable Linux Ceph client rebuilds its cephx authorizer and then reconnects using the msgr1 messenger path. In a plausible scenario, a malicious, compromised, or attacker-controlled Ceph service endpoint causes or coincides with a newer service ticket becoming available, forcing ceph_x_update_authorizer() to rebuild the authorizer. If the rebuilt authorizer no longer fits in the previous buffer, the old ceph_buffer can be released while the connection handshake still retains a stale pointer to it. The attacker then triggers or waits for a reconnect. When the messenger sends the cached authorizer during reconnect, the kernel may copy from freed memory in tcp_sendmsg(), causing a use-after-free condition and likely crashing or destabilizing the client system. There is no reliable public exploit maturity indicated in the input, and the described behavior most directly supports denial-of-service rather than confirmed code execution.

How to fix it

Apply a Linux kernel update that includes the libceph fix to refresh auth->authorizer_buf and auth->authorizer_buf_len after successful authorizer rebuilds. No exact affected product list or fixed package versions were provided, so use the fixed kernel versions supplied by the relevant Linux distribution, appliance vendor, cloud image provider, or kernel maintainers. Prioritize systems that use CephFS, RBD, or other Ceph storage through the in-kernel client. Where immediate patching is not possible, reduce exposure by avoiding untrusted Ceph clusters, restricting network access between Ceph clients and Ceph monitors/OSDs/MDS services, preferring trusted and patched Ceph infrastructure, and reviewing whether msgr1 can be disabled where operationally supported. Mitigations should not be treated as equivalent to patching because the flaw is in kernel memory handling.

How to confirm the fix worked

Confirm remediation by verifying that the running kernel package or build includes the upstream libceph change that refreshes cached authorizer buffer pointers after ceph_x_update_authorizer() rebuilds the authorizer. Validate that the host has rebooted into the fixed kernel, not merely installed it. Inventory active Ceph kernel-client usage by checking mounted Ceph filesystems, mapped RBD devices, loaded ceph/libceph kernel modules, and Ceph-related systemd units. Review distribution advisories for the exact fixed kernel build. In test environments, exercise Ceph authentication ticket refresh and reconnect behavior and confirm that no KASAN, slab-use-after-free, tcp_sendmsg(), _copy_from_iter(), libceph, or ceph_x_* kernel warnings occur.

Typical attack path

1. Identify Linux systems using the in-kernel Ceph client with cephx authentication and msgr1-capable connections.
2. Gain control of, impersonate, or influence a Ceph service endpoint or otherwise create conditions that cause service-ticket refresh behavior.
3. Cause the client to rebuild its cephx authorizer so the new authorizer requires a newly allocated buffer.
4. Ensure the previous authorizer buffer is released while the cached handshake pointer still references the freed memory.
5. Trigger or wait for a messenger reconnect on the affected client.
6. The client attempts to send the stale authorizer pointer, causing a kernel use-after-free and potential crash or service disruption.

How to detect it

Look for evidence of kernel memory faults or crashes on Linux systems using Ceph kernel clients. Primary log sources include journald, /var/log/kern.log, /var/log/messages, /var/log/syslog, dmesg output, crash dumps, kdump/vmcore artifacts, and kernel panic/oops records. Search for KASAN slab-use-after-free reports involving _copy_from_iter(), tcp_sendmsg(), libceph, ceph_x_create_authorizer(), ceph_x_update_authorizer(), ceph_x_build_authorizer(), or Ceph messenger reconnect activity. Correlate any kernel oops or panic with Ceph authentication refresh, service ticket renewal, monitor reconnects, OSD reconnects, MDS reconnects, or network instability affecting Ceph connections. If crash dumps are available, confirm whether the faulting call path includes tcp_sendmsg() copying the Ceph authorizer buffer from a freed slab object. Network indicators are not expected to be distinctive because the trigger resembles normal Ceph client/server traffic and authentication behavior.

• KASAN: slab-use-after-free
• BUG: KASAN: slab-use-after-free
• slab-use-after-free in _copy_from_iter
• _copy_from_iter
• tcp_sendmsg
• ceph_x_create_authorizer
• ceph_x_update_authorizer
• ceph_x_build_authorizer
• libceph
• ceph:
• cephx
• msgr1
• authorizer
• kernel BUG
• kernel panic
• Oops:
• Call Trace:

What your security team should do

• Inventory Linux systems using the in-kernel Ceph client, including CephFS mounts and RBD mappings.
• Prioritize kernel updates for production hosts that depend on Ceph-backed storage or connect to shared/multi-tenant Ceph clusters.
• Verify systems are rebooted into the fixed kernel after patch installation.
• Restrict Ceph client network access to trusted Ceph monitor, OSD, and MDS endpoints only.
• Review whether msgr1 is enabled or required; disable legacy messenger protocol support where vendor guidance and compatibility allow.
• Monitor kernel logs for use-after-free, KASAN, BUG, WARNING, panic, or oops messages involving libceph, cephx, _copy_from_iter(), or tcp_sendmsg().
• Treat unexpected crashes of Ceph client hosts during reconnects or authentication refresh as potentially security-relevant until logs are reviewed.
• Track Linux distribution advisories for exact fixed package versions because none were provided in the input.