The vulnerability arises when the Linux kernel decodes Ceph keys without enforcing a maximum key length. An oversized key may overflow the fixed‑size buffer used in process_auth_done(), enabling a classic buffer overflow that corrupts kernel memory. The weakness aligns with CWE‑121 (Stack Buffer Overflow) and CWE‑1284 (Improper Restriction of Operations within the Bounds of a Memory Buffer). This can allow privilege escalation, data tampering, or denial of service.

The affected product is the Linux kernel in any version that uses Ceph authentication without the CEPH_MAX_KEY_LEN check. The fix was introduced in later kernel releases; any kernel version prior to that commit is vulnerable when it receives Ceph authentication traffic containing oversized keys. Systems running unpatched kernels that interact with Ceph clusters or provide authentication services are at risk.

The CVSS score of 9.8 classifies the flaw as critical. The EPSS score of <1% indicates a low but non‑zero probability of exploitation, and the vulnerability is not listed in CISA KEV. Exploitation requires an attacker to send crafted Ceph authentication traffic that includes an unusually large key to a vulnerable kernel. Based on the description, it is inferred that the attack vector is remote over the network. Consequently, the overall risk is high for exposed systems, while the likelihood of attack remains comparatively low.