The Linux kernel contains a sign‑to‑unsigned conversion flaw (CWE‑681) in ceph_monmap_decode() where signed int variables blob_len and num_mon are used to store non‑negative values that are decoded from a Ceph monitor map. An excessively large unsigned value can be interpreted as a negative signed integer, so the subsequent check against CEPH_MAX_MON is bypassed. When this value is later cast to an unsigned u32 for memory allocation, the kernel attempts to allocate an enormous block of memory, which typically fails and returns –ENOMEM. This may result in an unexpected error response from ceph_monmap_decode() and could disrupt normal operation of the Ceph monitor service.

The flaw affects all Linux kernel releases that contain the libceph component with the original ceph_monmap_decode() implementation. Versions patched to declare blob_len and num_mon as u32 are not vulnerable. The entire range of pre‑patch kernels is therefore at risk.

Based on the description, the likely attack vector involves an attacker supplying a crafted Ceph monitor map with an oversized num_mon value to a node running the affected kernel. The CVSS score of 7.5 indicates high severity. The EPSS score of < 1 % represents a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. If exploited, the kernel may attempt to allocate an abnormally large block of memory and subsequently fail, leading to an error condition that could disrupt Ceph services or affect stability.