In the Linux kernel, the libceph client contains a race condition between ceph_destroy_client and a concurrent read of the monitor map debugfs file, causing a use‑after‑free. This flaw allows an attacker to access freed kernel memory, potentially corrupting the kernel, crashing the system, and compromising confidentiality, integrity, or availability.

The vulnerability affects the Linux kernel on any configuration that includes the libceph client code without the updated removal of debugfs entries prior to client teardown; no specific kernel version numbers are given in the available data.

The use‑after‑free poses a risk if an attacker can trigger a concurrent read of the monmap debugfs file from a context that has instantiated a Ceph monitor client. No exploit is publicly documented in the provided references. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, implying limited knowledge of exploitation activity. The applied fix drains active handlers and removes the debugfs files before the client is torn down, eliminating the race.