Executive brief
The Linux kernel's Ceph distributed filesystem module has a race condition in capability management that can cause the system to crash when a capability structure is accessed after being freed by another thread. An attacker with local access to a system using Ceph could trigger this crash, causing a denial of service. The vulnerability affects all versions of the Linux kernel that include the Ceph module.
Technical details
This is a use-after-free vulnerability in the Ceph filesystem driver (fs/ceph module) in the capability trimming code path. The root cause is a race condition in ceph_iterate_session_caps(): after releasing session->s_cap_lock, a capability structure can be removed by another thread before the callback function (cb) uses it, causing a use-after-free crash. The fix involves capturing the MDS (Metadata Server) ID before releasing the lock, then passing only the MDS ID to the callback rather than the stale cap pointer, and re-checking cap existence after acquiring ci->i_ceph_lock. The attack vector requires local code execution with the ability to trigger concurrent cap trimming operations on a Ceph-mounted filesystem. A patch was committed upstream (commit aaf67de78807c59c35bafb5003d4fb457c764800) and backported to stable kernel branches.
Affected products
- Linux Linux kernel All versions with Ceph filesystem module (affected from early versions through at least 6.19; patched in multiple stable branches)
Timeline
- 2023-04-19: disclosed: Fix commit authored by Xiubo Li
- 2023-05-11: patched: Backported to stable kernel branches by Greg Kroah-Hartman
- 2025-12-24: advisory: CVE-2023-53867 published on NVD