The Linux kernel contains a sign‑to‑unsigned conversion flaw in ceph_monmap_decode() where signed int variables blob_len and num_mon are used to store non‑negative values that are decoded from a Ceph monitor map. These variables should be u32, but due to the mismatch an oversized unsigned value can be interpreted as a negative signed integer, causing the check against CEPH_MAX_MON to fail. When this value is later cast to an unsigned u32 for memory allocation, the kernel attempts to allocate an enormous block of memory, which typically fails and returns –ENOMEM. This failure may disrupt normal operation of Ceph services.

The flaw affects all Linux kernel releases that contain the libceph component with the original ceph_monmap_decode() implementation. Versions patched to declare blob_len and num_mon as u32 are not vulnerable, so the entire range of pre‑patch kernels is at risk.

The likely attack vector involves an attacker supplying a crafted Ceph monitor map with an oversized num_mon value to a node running the affected kernel. The CVSS score of 7.5 indicates high severity. The EPSS score of < 1 % represents a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA KEV. If exploited, the kernel may attempt to allocate an abnormally large block of memory and subsequently fail, leading to an error condition that could disrupt Ceph services or affect system stability.